These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A null pointer dereference vulnerability exists in GNU Binutils 2.47, specifically in the elf_orphan_compatible function of the ld/ldelf.c file. This issue affects the ELF Orphan Section Handler component and requires local access to be exploited. The vulnerability has been publicly disclosed and an exploit has been released. System administrators and security teams should assess exposure and prioritize m [truncated]
A buffer overflow vulnerability was detected in GNU Binutils 2.47, specifically in the _bfd_elf_write_section_eh_frame function of the bfd/elf-eh-frame.c file. This issue is triggered by manipulating the cie_length, fde_length, augmentation_data_size, or write_offset arguments, and requires local access to exploit. The exploit is public, but the project has not yet responded to the bug report.
A buffer overflow vulnerability exists in GNU Binutils 2.47, specifically in the elf_x86_64_relocate_section function of the bfd/elf64-x86-64.c file. This issue is addressed in version 2.48. The vulnerability requires local access to be exploited. Successful exploitation could lead to a denial of service (DoS) or potentially allow local attackers to execute arbitrary code. System administrators and develo [truncated]
A weakness has been identified in GNU Binutils 2.47, specifically in the function bfd_putl64 of the file bfd/libbfd.c in the ld component. This issue causes a null pointer dereference and requires local access to exploit. The project was informed early through a bug report but has not yet responded. The vulnerability has been made publicly available, potentially allowing for attacks. Defenders should asse [truncated]
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader. This issue allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The vulnerability arises from the loader multiplying image dimensions and channel count using signed integer arithmetic, which can wrap to a negative number for sufficiently larg [truncated]
GNU Emacs for Android is affected by a vulnerability in the sfnt_read_table_directory() function, which improperly validates table header input. This can lead to the use of uninitialized heap data, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. The vulnerability is caused by an incorrect comparison variable in the read-length check, allowing a craft [truncated]
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer ove [truncated]
GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c when processing crafted TrueType font files, leading to heap buffer overflow writes and potential code execution. This issue, fixed in commit c4e20777c26548722a37b03db93243e83a0d6188, can be exploited via malicious font files delivered through email, EWW, or documents with custom faces. User [truncated]
The GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c, which allows a crafted TrueType variable font to trigger a heap-based out-of-bounds read via memcpy. This exposes heap memory contents that can be later used to defeat ASLR. Users of GNU Emacs for Android, especially those who process untrusted font files, should be aware of this vulnerability and take steps to [truncated]
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence i [truncated]
GNU cpio is vulnerable to uncontrolled memory allocation in the make_path function at src/makepath.c, allowing a denial of service via crafted archive. The function uses alloca to allocate stack memory based on argpath length, derived from an archive-controlled pathname during extraction. A malicious cpio archive with a sufficiently long nested pathname causes unbounded stack allocation, resulting in a st [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record for CVE-2026-66484, published on 2026-08-10T11:17:27.620Z, describes a Path Traversal vulnerability in GNU cpio's tar archive extraction functionality. This vulnerability allows an attacker to create a hard link to an existing file outside the intended extraction directory by providing a tar archive with a hard-link entry w [truncated]
The CVE-2026-56389 vulnerability in GNU Bison allows for arbitrary program execution during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML-to-HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). This behavior allows execution of an a [truncated]
GNU coreutils uniq is vulnerable to an out-of-bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing read [truncated]
The diff3 tool from GNU diffutils is vulnerable to a heap-based buffer overflow due to multiple signed integer overflows in line-mapping calculations. This occurs when processing crafted diff output, which may cause the application to allocate insufficient memory and subsequently perform out-of-bounds writes during internal processing. An attacker who can control the output of the diff program used by dif [truncated]
A buffer overflow vulnerability has been identified in the 'extension/readdir.c' program file of gawk, specifically in the ftype() routine. This issue could be used to crash the program and potentially achieve code execution, although the latter has not been confirmed to be feasible. The vulnerability affects gawk in versions 5.4.0 and below. The issue was reported by [email protected] and other sources. The CV [truncated]
A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035, impacting the function decompress_R2004_section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. Upgrading to version 0.14.8396 will fix this issue. This patch is called 3d0f9fc2eddbd6579c99af3111c37c98f03475d0. Users [truncated]
CVE-2026-56289 is a denial of service vulnerability in GNU patch. The vulnerability is caused by improper validation of hunk line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevent [truncated]
CVE-2026-56288 is a NULL pointer dereference vulnerability in GNU patch. The vulnerability occurs when processing a specially crafted unified-diff patch file, which can cause the application to pass a NULL pointer to fwrite() during patch processing. This can be triggered by a malicious patch file, leading to a denial of service. The vulnerability has been fixed in the commit e6d6a4e021660679d7fc9150f981d [truncated]
A heap-based buffer overflow vulnerability exists in GNU libredwg through version 0.13.4.8160, specifically within the bit_read_RC function in bits.c, which is part of the Dwgbmp Utility component. The vulnerability is remotely exploitable and has been assigned a CVSS 4.0 score of 5.5 (MEDIUM). The issue was published on 2026-05-27. A proof-of-concept exploit has been made publicly available, increasing t [truncated]
A local out-of-bounds read vulnerability exists in GNU LibreDWG through version 0.14, specifically within the read_2004_compressed_section function in src/decode.c. The vulnerability affects the Dwgbmp Utility component and can be triggered through manipulation of DWG file processing. The issue was disclosed publicly on 2026-05-26 with a CVSS 4.0 score of 1.9 (LOW severity), reflecting the local attack ve [truncated]
A local out-of-bounds read vulnerability exists in GNU LibreDWG through version 0.14, specifically within the `bit_convert_TU` function in `programs/dwggrep.c` of the Dwggrep utility. The vulnerability allows a local attacker to trigger an out-of-bounds read condition. The CVSS 4.0 score of 1.9 (LOW severity) reflects the local attack vector and limited impact scope. A patch is available via commit `be996 [truncated]
A heap-based buffer overflow vulnerability exists in GNU LibreDWG through version 0.14, specifically within the `decompress_R2004_section` function in `src/decode.c`. The vulnerability affects the Dwgread Utility component and requires local access to exploit. The CVSS 4.0 score of 1.9 reflects low severity due to local attack vector and low privileges required, though the exploit is publicly available. A [truncated]
A local-only assertion failure vulnerability exists in GNU LibreDWG versions up to 0.14, specifically within the decompress_R2004_section function in src/decode.c. The vulnerability allows a local attacker to trigger a reachable assertion through crafted input to the Dwgread Utility. The CVSS 4.0 score of 1.9 (LOW) reflects the local attack vector and limited availability impact. The vulnerability was pub [truncated]
A heap-based buffer overflow vulnerability exists in GNU LibreDWG versions up to 0.14, specifically within the `read_2004_compressed_section` function in `src/decode.c`. The vulnerability is triggered when processing malformed DWG files through the Dwgread Utility. The CVSS 4.0 score of 1.9 (LOW severity) reflects the local attack vector and low privileges required, with limited impacts on confidentiality [truncated]
A NULL pointer dereference vulnerability exists in GNU SASL versions prior to 2.2.3, specifically within the DIGEST-MD5 authentication mechanism implementation. The flaw resides in lib/digest-md5/getsubopt.c and is triggered when parsing a known token that lacks an accompanying '=' character. This vulnerability affects both client and server implementations, allowing remote unauthenticated attackers to ca [truncated]
A race condition vulnerability exists in GNU sed when invoked with both the -i (in-place edit) and --follow-symlinks options. The function open_next_file() performs two separate, non-atomic filesystem operations: first resolving a symlink to its target path for determining output location, then opening the original symlink path to read content. An attacker who can atomically replace the symlink between th [truncated]
CVE-2026-24061 is an argument injection vulnerability in GNU InetUtils that CISA added to its Known Exploited Vulnerabilities catalog on 2026-01-26. Because it is listed in KEV, organizations that use or bundle InetUtils should treat remediation as time-sensitive and follow the official vendor guidance and CISA instructions.
CVE-2025-61662 is a high-severity use-after-free in GRUB2’s gettext module. The issue arises when the gettext command remains registered after its module is unloaded, leaving an orphaned command that can access freed memory. The published record centers on crash/denial of service, while the CVSS vector also reflects possible confidentiality and integrity impact.
A Use-after-Free vulnerability in the GRUB2 bootloader's network module allows attackers with local access to trigger system instability and denial of service. The flaw occurs because the `net_set_vlan` command remains registered after the network module is unloaded, enabling access to freed memory. Published November 18, 2025, and last modified May 19, 2026.