#Memory Corruption
All CosmicBytez Labs articles tagged #Memory Corruption, across news, security advisories, how-to guides, and projects.
- News
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX 1.30.6 and 1.31.7 patch five flaws — three CVSS 9.2 memory bugs with possible RCE and a TLS bug that may let attackers skip client-cert checks.
- Security
CVE-2026-73790: HPE NonStop iTP WebServer Input Validation Flaw Enables Remote Crash
Unauthenticated, network-exploitable input validation bug in HPE NonStop iTP WebServer can corrupt memory and shut down the system.
- Security
CVE-2026-104192: Dragonfly In-Memory Database Double-Free RCE
A CVSS 9.6 double-free in Dragonfly's RDB stream loader lets unauthenticated clients trigger memory corruption; auth is off by default.
- Security
CVE-2026-86950: Apple CoreGraphics Out-of-Bounds Write Enables Arbitrary Code Execution
An out-of-bounds write in Apple CoreGraphics lets a malicious file trigger code execution on iOS, iPadOS, and macOS; CVSS 8.8, patched September 28.
- Security
CVE-2026-94083 & CVE-2026-94084: Suricata DoH2/HTTP2 Flaws Let Attackers Crash IDS/IPS
Suricata 8.0.7 fixes two CVSS 9.4 unauthenticated crash bugs in its DoH2 and HTTP/2 parsers that can blind network monitoring. Upgrade now.
- Security
CVE-2026-39919: Ghostscript JPEG 2000 Heap Buffer Overflow
Ghostscript before 10.08.0 has a critical heap overflow in its JPEG 2000 decoder, triggered by a crafted PDF; update to 10.08.0 now.
- Security
CVE-2026-28911: macOS Critical Memory Corruption via Malicious App
A critical memory corruption vulnerability in macOS allows a malicious application to corrupt memory of a system process. Apple patched the flaw in macOS...
- News
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Security researcher Yuhang Wu published a working PoC exploiting two Ruby memory corruption vulnerabilities in the Oj JSON parser to achieve RCE as the...
- Security
CVE-2026-42533: NGINX Memory Corruption via Map Directive Regex (CVSS 8.1)
A vulnerability in NGINX Plus and NGINX Open Source allows map directives using regex matching with capture variables to trigger memory corruption when...
- News
New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution
Exim has released security updates to patch a severe vulnerability affecting GnuTLS-compiled builds of the world's most widely deployed mail transfer...
- Security
CVE-2026-8053: MongoDB Time-Series Out-of-Bounds Write
An authenticated user with database write privileges can trigger an out-of-bounds memory write in the mongod process via a flaw in MongoDB Server's...
- Security
CVE-2026-6786: Memory Safety Bugs in Firefox and Thunderbird
Multiple memory safety bugs in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9 carry a CVSS 8.1 High rating. Some bugs show...
- Security
CVE-2026-20889: LibRaw x3f_thumb_loader Heap Buffer
A critical heap-based buffer overflow in LibRaw's x3f_thumb_loader allows an attacker to trigger memory corruption via a specially crafted RAW image file,...
- Security
CVE-2026-20911: LibRaw HuffTable::initval Heap Buffer
A critical heap-based buffer overflow in LibRaw's HuffTable::initval function allows an attacker to corrupt heap memory via a malicious RAW image file,...
- Security
CVE-2026-21413: LibRaw lossless_jpeg_load_raw Heap Buffer
A critical heap-based buffer overflow in LibRaw's lossless_jpeg_load_raw function allows an attacker to cause memory corruption and potential code...
- Security
CVE-2026-5731: Firefox and Thunderbird Critical Memory
Mozilla has patched critical memory safety bugs in Firefox, Firefox ESR, and Thunderbird that showed evidence of memory corruption. Exploiting these flaws...
- Security
CVE-2025-43510: Apple Multiple Products Improper Locking
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability allowing a malicious app to cause unexpected changes in...