Common Weakness Enumeration
CWE-129
AllowedImproper Validation of Array Index
Abstraction: Variant · Status: Draft
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
897 vulnerabilities reference this CWE, most recent first.
CVE-2026-116816 (GCVE-0-2026-116816)
Vulnerability from cvelistv5 – Published: 2026-10-27 00:33 – Updated: 2026-10-27 00:33
VLAI
EPSS
VEX
Title
llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
Summary
llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.
Severity
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/ggml-org/llama.cpp/pull/25969 | issue-trackingpatch |
| https://github.com/ggml-org/llama.cpp/pull/26511 | patchissue-tracking |
| https://github.com/ggml-org/llama.cpp/commit/cf06… | patch |
| https://github.com/ggml-org/llama.cpp/blob/b10259… | technical-description |
| https://github.com/ggml-org/llama.cpp/releases/ta… | release-notes |
| https://www.vulncheck.com/advisories/llama-cpp-b5… | third-party-advisory |
Impacted products
Date Public
2026-07-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ggml-org/llama.cpp",
"product": "llama.cpp",
"vendor": "ggml-org",
"versions": [
{
"lessThan": "b10261",
"status": "affected",
"version": "b5899",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "b10261",
"versionStartIncluding": "b5899",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pedro Cruz (g4nkd)"
},
{
"lang": "en",
"type": "reporter",
"value": "Jeongwoo Lee"
},
{
"lang": "en",
"type": "remediation developer",
"value": "CISC"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like \u003c0x-1\u003e whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T00:33:58.581Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/pull/25969"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/ggml-org/llama.cpp/pull/26511"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/commit/cf06ad7dfe79e7bf2934150d4fefe1ce8db05490"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ggml-org/llama.cpp/blob/b10259/src/llama-vocab.cpp#L1376-L1377"
},
{
"name": "llama.cpp b10261 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ggml-org/llama.cpp/releases/tag/b10261"
},
{
"name": "VulnCheck Advisory: llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/llama-cpp-b5899-before-b10261-heap-out-of-bounds-write-via-plamo2-tokenizer"
}
],
"title": "llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116816",
"datePublished": "2026-10-27T00:33:58.581Z",
"dateReserved": "2026-10-26T22:13:56.315Z",
"dateUpdated": "2026-10-27T00:33:58.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116731 (GCVE-0-2026-116731)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-10-26 21:52
VLAI
EPSS
VEX
Title
Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import
Summary
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
Severity
6.1 (Medium)
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/tildearrow/furnace/issues/2966 | issue-tracking |
| https://github.com/tildearrow/furnace | product |
| https://github.com/tildearrow/furnace/commit/c120… | patch |
| https://github.com/tildearrow/furnace/blob/v0.6.8… | technical-description |
| https://hackmd.io/@haindpwn/furnace-ftm-import-no… | third-party-advisory |
| https://www.vulncheck.com/advisories/furnace-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tildearrow | furnace |
Affected:
0 , ≤ 0.6.8.3
(custom)
cpe:2.3:a:tildearrow:furnace:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/tildearrow/furnace",
"product": "furnace",
"repo": "https://github.com/tildearrow/furnace",
"vendor": "tildearrow",
"versions": [
{
"lessThanOrEqual": "0.6.8.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tildearrow:furnace:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.6.8.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T21:52:32.953Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2966",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tildearrow/furnace/issues/2966"
},
{
"tags": [
"product"
],
"url": "https://github.com/tildearrow/furnace"
},
{
"tags": [
"patch"
],
"url": "https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L1597-L1605"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob"
},
{
"name": "VulnCheck Advisory: Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-write-via-famitracker-grooves-block-import"
}
],
"title": "Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116731",
"datePublished": "2026-10-26T21:52:32.953Z",
"dateReserved": "2026-10-26T20:23:35.128Z",
"dateUpdated": "2026-10-26T21:52:32.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116590 (GCVE-0-2026-116590)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:48 – Updated: 2026-10-26 21:48
VLAI
EPSS
VEX
Title
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
Summary
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.
Severity
5.9 (Medium)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/xerial/snappy-java/security/ad… | x_refsource_CONFIRM |
| https://github.com/xerial/snappy-java/pull/741 | x_refsource_MISC |
| https://github.com/xerial/snappy-java/commit/2d7c… | x_refsource_MISC |
| https://github.com/xerial/snappy-java/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xerial | snappy-java |
Affected:
< 1.1.10.9
|
{
"containers": {
"cna": {
"affected": [
{
"product": "snappy-java",
"vendor": "xerial",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.10.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T21:48:15.468Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7"
},
{
"name": "https://github.com/xerial/snappy-java/pull/741",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xerial/snappy-java/pull/741"
},
{
"name": "https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b"
},
{
"name": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"
}
],
"source": {
"advisory": "GHSA-xqrx-qh46-34m7",
"discovery": "UNKNOWN"
},
"title": "snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-116590",
"datePublished": "2026-10-26T21:48:15.468Z",
"dateReserved": "2026-10-26T15:03:39.036Z",
"dateUpdated": "2026-10-26T21:48:15.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116585 (GCVE-0-2026-116585)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:06 – Updated: 2026-10-26 21:06
VLAI
EPSS
VEX
Title
Go JOSE: Panic during CBC-HMAC processing
Summary
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.
Severity
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-jose/go-jose/security/advis… | x_refsource_CONFIRM |
| https://github.com/go-jose/go-jose/pull/292 | x_refsource_MISC |
| https://github.com/go-jose/go-jose/commit/35883f7… | x_refsource_MISC |
| https://github.com/go-jose/go-jose/commit/74114c2… | x_refsource_MISC |
| https://github.com/go-jose/go-jose/releases/tag/v4.1.5 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "go-jose",
"vendor": "go-jose",
"versions": [
{
"status": "affected",
"version": "\u003c 4.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T21:06:35.189Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"
},
{
"name": "https://github.com/go-jose/go-jose/pull/292",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-jose/go-jose/pull/292"
},
{
"name": "https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6"
},
{
"name": "https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54"
},
{
"name": "https://github.com/go-jose/go-jose/releases/tag/v4.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-jose/go-jose/releases/tag/v4.1.5"
}
],
"source": {
"advisory": "GHSA-4w3g-jfj2-cw2q",
"discovery": "UNKNOWN"
},
"title": "Go JOSE: Panic during CBC-HMAC processing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-116585",
"datePublished": "2026-10-26T21:06:35.189Z",
"dateReserved": "2026-10-26T15:03:39.036Z",
"dateUpdated": "2026-10-26T21:06:35.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116181 (GCVE-0-2026-116181)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:20 – Updated: 2026-10-25 13:20
VLAI
EPSS
VEX
Title
vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids
Summary
vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.
Severity
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/vllm-project/vllm/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/vllm-0.20.1-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vllm-project | vllm |
Affected:
0.20.1 , < 0.29.0
(semver)
Unaffected: 0.29.0 (semver) cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* |
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/vllm",
"product": "vllm",
"vendor": "vllm-project",
"versions": [
{
"lessThan": "0.29.0",
"status": "affected",
"version": "0.20.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.29.0",
"versionStartIncluding": "0.20.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mschwarzl"
},
{
"lang": "en",
"type": "coordinator",
"value": "jperezdealgaba"
},
{
"lang": "en",
"type": "finder",
"value": "QwertyJack"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner\u0027s logits buffer."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:20:19.874Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-w9r6-29q4-pvpr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-w9r6-29q4-pvpr"
},
{
"name": "VulnCheck Advisory: vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vllm-0.20.1-before-0.29.0-dos-and-gpu-out-of-bounds-write-via-stop-token-ids"
}
],
"title": "vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116181",
"datePublished": "2026-10-25T13:20:19.874Z",
"dateReserved": "2026-10-25T12:26:13.487Z",
"dateUpdated": "2026-10-25T13:20:19.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115916 (GCVE-0-2026-115916)
Vulnerability from cvelistv5 – Published: 2026-10-26 17:18 – Updated: 2026-10-26 17:18
VLAI
EPSS
VEX
Title
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
Summary
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.
Severity
6.5 (Medium)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vllm-project/vllm/security/adv… | x_refsource_CONFIRM |
| https://github.com/vllm-project/vllm/pull/59491 | x_refsource_MISC |
| https://github.com/vllm-project/vllm/commit/37cec… | x_refsource_MISC |
| https://github.com/vllm-project/vllm/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vllm-project | vllm |
Affected:
< 0.32.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "vllm",
"vendor": "vllm-project",
"versions": [
{
"status": "affected",
"version": "\u003c 0.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-193",
"description": "CWE-193: Off-by-one Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T17:18:17.582Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q97c-p368-75c4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q97c-p368-75c4"
},
{
"name": "https://github.com/vllm-project/vllm/pull/59491",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/pull/59491"
},
{
"name": "https://github.com/vllm-project/vllm/commit/37cecc8141e2dcba9dd534897a164d4baaf27229",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/commit/37cecc8141e2dcba9dd534897a164d4baaf27229"
},
{
"name": "https://github.com/vllm-project/vllm/releases/tag/v0.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.32.0"
}
],
"source": {
"advisory": "GHSA-q97c-p368-75c4",
"discovery": "UNKNOWN"
},
"title": "vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-115916",
"datePublished": "2026-10-26T17:18:17.582Z",
"dateReserved": "2026-10-23T20:21:45.107Z",
"dateUpdated": "2026-10-26T17:18:17.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115722 (GCVE-0-2026-115722)
Vulnerability from cvelistv5 – Published: 2026-10-23 11:36 – Updated: 2026-10-23 11:36
VLAI
EPSS
VEX
Title
RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header
Summary
RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.
Severity
6.1 (Medium)
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/diegonehab/rply/issues/10 | issue-tracking |
| https://github.com/diegonehab/rply/blob/75639e3f1… | technical-description |
| https://github.com/diegonehab/rply/blob/75639e3f1… | technical-description |
| https://hackmd.io/@haindpwn/rply-property-list-ty… | third-party-advisory |
| https://www.vulncheck.com/advisories/rply-through… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| diegonehab | rply |
Affected:
0 , ≤ 1.1.4
(semver)
|
Date Public
2026-10-21 12:48
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/diegonehab/rply",
"product": "rply",
"repo": "https://github.com/diegonehab/rply",
"vendor": "diegonehab",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-21T12:48:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property\u0027s length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T11:36:46.355Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/diegonehab/rply/issues/10"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L1228-L1251"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/diegonehab/rply/blob/75639e3f12755ca64559d45a4a0bcffc52e04ef8/rply.c#L821-L848"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/rply-property-list-type-confusion"
},
{
"name": "VulnCheck Advisory: RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rply-through-1.1.4-out-of-bounds-function-pointer-index-via-ply-header"
}
],
"title": "RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115722",
"datePublished": "2026-10-23T11:36:46.355Z",
"dateReserved": "2026-10-23T11:26:42.342Z",
"dateUpdated": "2026-10-23T11:36:46.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114405 (GCVE-0-2026-114405)
Vulnerability from cvelistv5 – Published: 2026-10-21 12:27 – Updated: 2026-10-21 17:19
VLAI
EPSS
VEX
Title
Denial of Service via Malformed VATP Packet in Velneo vServer
Summary
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 15:19 UTC
CWE
- CWE-129 - Improper validation of array index
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://velneo.es/avisos-de-seguridad/ | vendor-advisorypatch |
Impacted products
Date Public
2026-10-21 12:08
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T15:19:10.085763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:19:14.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vServer",
"vendor": "Velneo",
"versions": [
{
"lessThan": "36.6",
"status": "affected",
"version": "36.0",
"versionType": "custom"
},
{
"lessThan": "37.2",
"status": "affected",
"version": "37.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "36.6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "37.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "36.6",
"versionStartIncluding": "36.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "37.2",
"versionStartIncluding": "37.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:36.6:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:velneo:vserver:37.2:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luis Sobrecueva"
}
],
"datePublic": "2026-10-21T12:08:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of array index vulnerability in Velneo vServer.\u0026nbsp;This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2."
}
],
"value": "Improper validation of array index vulnerability in Velneo vServer.\u00a0This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper validation of array index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:27:00.706Z",
"orgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"shortName": "Velneo"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://velneo.es/avisos-de-seguridad/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability is patched in versions 36.6\u0026nbsp; and 37.2\u0026nbsp;"
}
],
"value": "The vulnerability is patched in versions 36.6\u00a0 and 37.2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Denial of Service via Malformed VATP Packet in Velneo vServer",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"assignerShortName": "Velneo",
"cveId": "CVE-2026-114405",
"datePublished": "2026-10-21T12:27:00.706Z",
"dateReserved": "2026-10-21T11:53:51.579Z",
"dateUpdated": "2026-10-21T17:19:14.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113881 (GCVE-0-2026-113881)
Vulnerability from cvelistv5 – Published: 2026-10-27 15:52 – Updated: 2026-10-27 15:52
VLAI
EPSS
VEX
Title
Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution
Summary
A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.
Severity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.watchguard.com/CVE-2026-113881 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WatchGuard | Fireware OS |
Affected:
2025.1 , < 2026.4
(custom)
Affected: 12.9 , < 12.12.4 (custom) cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:* cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Default"
],
"product": "Fireware OS",
"vendor": "WatchGuard",
"versions": [
{
"lessThan": "2026.4",
"status": "affected",
"version": "2025.1",
"versionType": "custom"
},
{
"lessThan": "12.12.4",
"status": "affected",
"version": "12.9",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis vulnerability affects Firebox deployments with Network Access Control enabled for a Mobile VPN.\u003c/p\u003e"
}
],
"value": "This vulnerability affects Firebox deployments with Network Access Control enabled for a Mobile VPN."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.4",
"versionStartIncluding": "2025.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.12.4",
"versionStartIncluding": "12.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "WatchGuard AI Security Research"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow vulnerability in Fireware OS\u0027s VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWatchGuard is not aware of any exploitation of this vulnerability in the wild.\u003c/p\u003e"
}
],
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-129",
"description": "CWE-129",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:52:28.229Z",
"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"shortName": "WatchGuard"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.watchguard.com/CVE-2026-113881"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fireware OS 2026.4, Fireware OS 12.12.4"
}
],
"value": "Fireware OS 2026.4, Fireware OS 12.12.4"
}
],
"title": "Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"assignerShortName": "WatchGuard",
"cveId": "CVE-2026-113881",
"datePublished": "2026-10-27T15:52:28.229Z",
"dateReserved": "2026-10-20T20:49:59.110Z",
"dateUpdated": "2026-10-27T15:52:28.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110934 (GCVE-0-2026-110934)
Vulnerability from cvelistv5 – Published: 2026-10-15 06:51 – Updated: 2026-10-15 14:54
VLAI
EPSS
VEX
Summary
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.
This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:54 UTC
CWE
- CWE-129 - Improper validation of array index
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Samsung Open Source | Vyond |
Affected:
0 , < be6e297b0c4836e20d73b2f8a40a561ea496ebaa
(git)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110934",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:54:13.798579Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T14:54:19.850Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Vyond",
"vendor": "Samsung Open Source",
"versions": [
{
"lessThan": "be6e297b0c4836e20d73b2f8a40a561ea496ebaa",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rose-tech-dev (Rose Machocho)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\u003cp\u003eThis issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.\u003c/p\u003e"
}
],
"value": "Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\n\nThis issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper validation of array index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T06:51:21.891Z",
"orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
"shortName": "samsung.tv_appliance"
},
"references": [
{
"url": "https://github.com/Samsung/Vyond/commit/be6e297b0c4836e20d73b2f8a40a561ea496ebaa"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
"assignerShortName": "samsung.tv_appliance",
"cveId": "CVE-2026-110934",
"datePublished": "2026-10-15T06:51:21.891Z",
"dateReserved": "2026-10-15T06:08:05.108Z",
"dateUpdated": "2026-10-15T14:54:19.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-7
Architecture and Design
Strategy: Input Validation
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Mitigation MIT-15
Architecture and Design
- For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.
Mitigation MIT-3
Requirements
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, Ada allows the programmer to constrain the values of a variable and languages such as Java and Ruby will allow the programmer to handle exceptions when an out-of-bounds index is accessed.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation
Strategy: Environment Hardening
- Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
- For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When accessing a user-controlled array index, use a stringent range of values that are within the target array. Make sure that you do not allow negative values to be used. That is, verify the minimum as well as the maximum of the range of acceptable values.
Mitigation MIT-35
Implementation
Be especially careful to validate all input when invoking code that crosses language boundaries, such as from an interpreted language to native code. This could create an unexpected interaction between the language boundaries. Ensure that you are not violating any of the expectations of the language with which you are interfacing. For example, even though Java may not be susceptible to buffer overflows, providing a large argument in a call to native code might trigger an overflow.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-22
Architecture and Design
Operation
Strategy: Sandbox or Jail
- Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
CAPEC-100: Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.