Tag
#remote code execution
Critical Stack Buffer Overflow Vulnerability in sngrep: CVE-2026-90558
A critical stack buffer overflow vulnerability (CVE-2026-90558) has been discovered in sngrep, a SIP network traffic grep tool, versions up to 1.8.4. The vulnerability has a CVSS score of 9.8 and allows attackers to execute arbitrary code or cause crashes by crafting malicious SIP packets with oversized header fields. The vulnerability is not actively exploited but poses a significant risk due to its high severity and potential for remote exploitation. Organizations are advised to upgrade to a patched version immediately.
Understanding the PixelSmash Vulnerability in FFmpeg
A critical vulnerability, CVE-2026-8461, has been discovered in the FFmpeg media processing framework, which can cause systems to crash or enable remote code execution. This vulnerability, dubbed PixelSmash, affects a wide range of applications, including desktop video players, Linux file-manager thumbnail generators, cloud transcoding pipelines, and self-hosted media servers. The vulnerability can be exploited by processing a single malicious media file.
Understanding and Defending Against CVE-2025-71348: A Remote Code Execution Vulnerability in picklescan
CVE-2025-71348 is a high-severity vulnerability in the picklescan library, which fails to detect malicious pickle files that can execute arbitrary code. This vulnerability, with a CVSS score of 8.1, allows attackers to craft pickle files that evade detection but execute during pickle.load, enabling remote code execution in supply chain attacks. The vulnerability affects picklescan versions before 0.0.28. Understanding this threat is crucial for defenders to protect against potential supply chain attacks.
esbuild Deno Module Vulnerability Enables Remote Code Execution
A vulnerability in the esbuild Deno module allows remote code execution via the NPM_CONFIG_REGISTRY environment variable due to missing binary integrity verification.