{"grype_matches":[{"artifact":{"id":"809ea4b423ef5f0e","cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.9-3\\+deb13u4:*:*:*:*:*:*:*"],"name":"libgnutls30t64","purl":"pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=gnutls28","type":"deb","version":"3.8.9-3+deb13u4","language":"","licenses":["sha256:a07e99815cf1998f1dabbc21fe199460bfa09b85ead0d56b49a32cac3d1791b5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnutls28","version":"3.8.9-3+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-09","epss":0.73327,"percentile":0.99453}],"risk":3.66635,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-09","epss":0.73327,"percentile":0.99453}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"risk":1.01325,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"risk":1.01325,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"risk":1.01325,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"risk":1.01325,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-09","epss":0.01351,"percentile":0.70694}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"4f58c885e32d1fec","cpes":["cpe:2.3:a:libpoppler147:libpoppler147:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"libpoppler147","purl":"pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler147/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpoppler147/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-09","epss":0.03312,"percentile":0.88236}],"risk":0.9935999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-09","epss":0.03312,"percentile":0.88236}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"4a1904c022e79f58","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/debian/poppler-utils@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-09","epss":0.03312,"percentile":0.88236}],"risk":0.9935999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-09","epss":0.03312,"percentile":0.88236}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"1159f482b12b5f01","cpes":["cpe:2.3:a:ghostscript:ghostscript:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"ghostscript","purl":"pkg:deb/debian/ghostscript@10.05.1~dfsg-1%2Bdeb13u1?arch=amd64&distro=debian-13.7","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ghostscript/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/ghostscript/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ghostscript.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ghostscript.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.list"},{"path":"/var/lib/dpkg/info/ghostscript.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.postinst"},{"path":"/var/lib/dpkg/info/ghostscript.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.05.1~dfsg-1+deb13u2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-39919","versionConstraint":"< 10.05.1~dfsg-1+deb13u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-39919","fix":{"state":"fixed","versions":["10.05.1~dfsg-1+deb13u2"],"available":[{"date":"2026-09-25","kind":"advisory","version":"10.05.1~dfsg-1+deb13u2"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"risk":0.71736,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6516-1","link":"https://security-tracker.debian.org/tracker/DSA-6516-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-39919","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"urls":["https://bugs.ghostscript.com/show_bug.cgi?id=709666","https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080","https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1","https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."}]},{"artifact":{"id":"5817a708ca9571e4","cpes":["cpe:2.3:a:libgs-common:libgs-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs-common:libgs_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs_common:libgs-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs_common:libgs_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs:libgs-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs:libgs_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgs-common","purl":"pkg:deb/debian/libgs-common@10.05.1~dfsg-1%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=ghostscript","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgs-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs-common.list"}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.05.1~dfsg-1+deb13u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39919","versionConstraint":"< 10.05.1~dfsg-1+deb13u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-39919","fix":{"state":"fixed","versions":["10.05.1~dfsg-1+deb13u2"],"available":[{"date":"2026-09-25","kind":"advisory","version":"10.05.1~dfsg-1+deb13u2"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"risk":0.71736,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6516-1","link":"https://security-tracker.debian.org/tracker/DSA-6516-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-39919","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"urls":["https://bugs.ghostscript.com/show_bug.cgi?id=709666","https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080","https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1","https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."}]},{"artifact":{"id":"fb50d606edd69206","cpes":["cpe:2.3:a:libgs10:libgs10:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgs10","purl":"pkg:deb/debian/libgs10@10.05.1~dfsg-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ghostscript","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgs10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.05.1~dfsg-1+deb13u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39919","versionConstraint":"< 10.05.1~dfsg-1+deb13u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-39919","fix":{"state":"fixed","versions":["10.05.1~dfsg-1+deb13u2"],"available":[{"date":"2026-09-25","kind":"advisory","version":"10.05.1~dfsg-1+deb13u2"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"risk":0.71736,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6516-1","link":"https://security-tracker.debian.org/tracker/DSA-6516-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-39919","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"urls":["https://bugs.ghostscript.com/show_bug.cgi?id=709666","https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080","https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1","https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."}]},{"artifact":{"id":"2e51e497614527b2","cpes":["cpe:2.3:a:libgs10-common:libgs10-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10-common:libgs10_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10_common:libgs10-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10_common:libgs10_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10:libgs10-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10:libgs10_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgs10-common","purl":"pkg:deb/debian/libgs10-common@10.05.1~dfsg-1%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=ghostscript","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs10-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgs10-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs10-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs10-common.list"}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.05.1~dfsg-1+deb13u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39919","versionConstraint":"< 10.05.1~dfsg-1+deb13u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-39919","fix":{"state":"fixed","versions":["10.05.1~dfsg-1+deb13u2"],"available":[{"date":"2026-09-25","kind":"advisory","version":"10.05.1~dfsg-1+deb13u2"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"risk":0.71736,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6516-1","link":"https://security-tracker.debian.org/tracker/DSA-6516-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-39919","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-09","epss":0.00784,"percentile":0.54725}],"urls":["https://bugs.ghostscript.com/show_bug.cgi?id=709666","https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080","https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1","https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"risk":0.70218,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"risk":0.70218,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"risk":0.70218,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection."},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-09","epss":0.00747,"percentile":0.53493}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-09","epss":0.00688,"percentile":0.51274}],"risk":0.6467200000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`."},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-09","epss":0.00688,"percentile":0.51274}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-09","epss":0.00688,"percentile":0.51274}],"risk":0.6467200000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`."},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-09","epss":0.00688,"percentile":0.51274}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-09","epss":0.00688,"percentile":0.51274}],"risk":0.6467200000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`."},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-09","epss":0.00688,"percentile":0.51274}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"risk":0.6423300000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"risk":0.6423300000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"risk":0.6423300000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"risk":0.6423300000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-09","epss":0.00702,"percentile":0.51854}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"risk":0.6324400000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66040","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"risk":0.6324400000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66040","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"risk":0.6324400000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66040","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"risk":0.6324400000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66040","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-09","epss":0.00776,"percentile":0.54471}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."}]},{"artifact":{"id":"147b3d90c1d1a5d5","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66046","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66046","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-10-09","epss":0.00742,"percentile":0.53315}],"risk":0.60102,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."},"relatedVulnerabilities":[{"id":"CVE-2026-66046","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-10-09","epss":0.00742,"percentile":0.53315}],"urls":["https://github.com/libexpat/libexpat/pull/1321","https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-09","epss":0.00661,"percentile":0.50116}],"risk":0.5982050000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains."},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-09","epss":0.00661,"percentile":0.50116}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-09","epss":0.00661,"percentile":0.50116}],"risk":0.5982050000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains."},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-09","epss":0.00661,"percentile":0.50116}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-09","epss":0.00661,"percentile":0.50116}],"risk":0.5982050000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains."},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-09","epss":0.00661,"percentile":0.50116}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]},{"artifact":{"id":"9f56c51e74431fad","cpes":["cpe:2.3:a:libarchive13t64:libarchive13t64:3.7.4-4\\+deb13u1:*:*:*:*:*:*:*"],"name":"libarchive13t64","purl":"pkg:deb/debian/libarchive13t64@3.7.4-4%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libarchive","type":"deb","version":"3.7.4-4+deb13u1","language":"","licenses":["Apache-2.0","BSD-1-clause-UCB","BSD-124-clause-UCB","BSD-2-clause","BSD-3-clause-UCB","BSD-4-clause-UCB","CC0-1.0","Expat","OpenSSL+SSLeay","PD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libarchive13t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libarchive13t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libarchive13t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libarchive13t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libarchive"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14164","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libarchive","version":"3.7.4-4+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-14164","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14164","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-14164","date":"2026-10-09","epss":0.00792,"percentile":0.55039}],"risk":0.594,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-14164","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-14164","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14164","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-14164","date":"2026-10-09","epss":0.00792,"percentile":0.55039}],"urls":["https://access.redhat.com/errata/RHSA-2026:30333","https://access.redhat.com/errata/RHSA-2026:52674","https://access.redhat.com/errata/RHSA-2026:52675","https://access.redhat.com/errata/RHSA-2026:54387","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:54769","https://access.redhat.com/errata/RHSA-2026:56954","https://access.redhat.com/errata/RHSA-2026:58558","https://access.redhat.com/errata/RHSA-2026:58573","https://access.redhat.com/errata/RHSA-2026:58574","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:62409","https://access.redhat.com/errata/RHSA-2026:63041","https://access.redhat.com/errata/RHSA-2026:63044","https://access.redhat.com/errata/RHSA-2026:63100","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:67857","https://access.redhat.com/errata/RHSA-2026:67935","https://access.redhat.com/errata/RHSA-2026:70586","https://access.redhat.com/errata/RHSA-2026:70615","https://access.redhat.com/errata/RHSA-2026:72394","https://access.redhat.com/errata/RHSA-2026:72395","https://access.redhat.com/errata/RHSA-2026:72399","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-14164","https://bugzilla.redhat.com/show_bug.cgi?id=2493411","https://github.com/libarchive/libarchive/issues/3069","https://github.com/libarchive/libarchive/pull/3071"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14164","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"risk":0.58887,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"risk":0.58887,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"risk":0.58887,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"risk":0.58887,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-09","epss":0.00727,"percentile":0.52765}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"a22d24d52d83d4d8","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.18-3.1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=cjson","type":"deb","version":"1.7.18-3.1+deb13u1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67215","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cjson","version":"1.7.18-3.1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-67215","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-10-09","epss":0.007,"percentile":0.51741}],"risk":0.567,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-67215","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-10-09","epss":0.007,"percentile":0.51741}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261","https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-10536","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-10536","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"risk":0.5621200000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation."},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10536","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-10536","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"risk":0.5621200000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation."},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10536","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-10536","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"risk":0.5621200000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation."},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-09","epss":0.00598,"percentile":0.47013}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9079","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-09","epss":0.00584,"percentile":0.46261}],"risk":0.54896,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them."},"relatedVulnerabilities":[{"id":"CVE-2026-9079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-09","epss":0.00584,"percentile":0.46261}],"urls":["https://curl.se/docs/CVE-2026-9079.html","https://curl.se/docs/CVE-2026-9079.json","https://hackerone.com/reports/3750295"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9079","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-09","epss":0.00584,"percentile":0.46261}],"risk":0.54896,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them."},"relatedVulnerabilities":[{"id":"CVE-2026-9079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-09","epss":0.00584,"percentile":0.46261}],"urls":["https://curl.se/docs/CVE-2026-9079.html","https://curl.se/docs/CVE-2026-9079.json","https://hackerone.com/reports/3750295"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9079","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-09","epss":0.00584,"percentile":0.46261}],"risk":0.54896,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them."},"relatedVulnerabilities":[{"id":"CVE-2026-9079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-09","epss":0.00584,"percentile":0.46261}],"urls":["https://curl.se/docs/CVE-2026-9079.html","https://curl.se/docs/CVE-2026-9079.json","https://hackerone.com/reports/3750295"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."}]},{"artifact":{"id":"a9126347f86cc263","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/debian/libcairo-gobject2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-09","epss":0.01824,"percentile":0.78169}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-09","epss":0.01824,"percentile":0.78169}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"ba412dc25febb8de","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-09","epss":0.01824,"percentile":0.78169}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-09","epss":0.01824,"percentile":0.78169}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"4f58c885e32d1fec","cpes":["cpe:2.3:a:libpoppler147:libpoppler147:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"libpoppler147","purl":"pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler147/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpoppler147/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9545","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9545","date":"2026-10-09","epss":0.01824,"percentile":0.78168}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9545","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero."},"relatedVulnerabilities":[{"id":"CVE-2019-9545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9545","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9545","date":"2026-10-09","epss":0.01824,"percentile":0.78168}],"urls":["https://gitlab.freedesktop.org/poppler/poppler/issues/731","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadtextregion-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9545","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero."}]},{"artifact":{"id":"4a1904c022e79f58","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/debian/poppler-utils@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9545","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9545","date":"2026-10-09","epss":0.01824,"percentile":0.78168}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9545","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero."},"relatedVulnerabilities":[{"id":"CVE-2019-9545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9545","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9545","date":"2026-10-09","epss":0.01824,"percentile":0.78168}],"urls":["https://gitlab.freedesktop.org/poppler/poppler/issues/731","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadtextregion-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9545","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"risk":0.52852,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"risk":0.52852,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"risk":0.52852,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-09","epss":0.00584,"percentile":0.46284}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"risk":0.52326,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"risk":0.52326,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"risk":0.52326,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"risk":0.52326,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-09","epss":0.00646,"percentile":0.49414}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"3747a63ebad1c96d","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-6988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-09","epss":0.01724,"percentile":0.76848}],"risk":0.5172,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."},"relatedVulnerabilities":[{"id":"CVE-2019-6988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-09","epss":0.01724,"percentile":0.76848}],"urls":["http://www.securityfocus.com/bid/106785","https://github.com/uclouvain/openjpeg/issues/1178"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."}]},{"artifact":{"id":"d205c238bdfb9a0e","cpes":["cpe:2.3:a:python3-pkg-resources:python3-pkg-resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg-resources:python3_pkg_resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3-pkg-resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3_pkg_resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3-pkg-resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3_pkg_resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3-pkg-resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3_pkg_resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pkg-resources:78.1.1-0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pkg_resources:78.1.1-0.1:*:*:*:*:*:*:*"],"name":"python3-pkg-resources","purl":"pkg:deb/debian/python3-pkg-resources@78.1.1-0.1?arch=all&distro=debian-13.7&upstream=setuptools","type":"deb","version":"78.1.1-0.1","language":"","licenses":["Apache-2.0","BSD-3-Clause","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-pkg-resources/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3-pkg-resources/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.list"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.postinst"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.prerm"}],"upstreams":[{"name":"setuptools"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23949","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"setuptools","version":"78.1.1-0.1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-23949","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23949","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23949","date":"2026-10-09","epss":0.00618,"percentile":0.48033}],"risk":0.49748999999999993,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-23949","description":"jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue."},"relatedVulnerabilities":[{"id":"CVE-2026-23949","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23949","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23949","date":"2026-10-09","epss":0.00618,"percentile":0.48033}],"urls":["https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91","https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9","https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2","https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23949","description":"jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue."}]},{"artifact":{"id":"a22d24d52d83d4d8","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.18-3.1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=cjson","type":"deb","version":"1.7.18-3.1+deb13u1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67216","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cjson","version":"1.7.18-3.1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-67216","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-10-09","epss":0.00645,"percentile":0.49395}],"risk":0.48374999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2026-67216","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-10-09","epss":0.00645,"percentile":0.49395}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."}]},{"artifact":{"id":"e2c0cfe2f366c89d","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.7.0-3\\+deb13u3:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64&distro=debian-13.7&upstream=tiff","type":"deb","version":"4.7.0-3+deb13u3","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-52490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tiff","version":"4.7.0-3+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-52490","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52490","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52490","date":"2026-10-09","epss":0.0051,"percentile":0.41725}],"risk":0.47940000000000005,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-52490","description":"An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c"},"relatedVulnerabilities":[{"id":"CVE-2026-52490","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52490","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52490","date":"2026-10-09","epss":0.0051,"percentile":0.41725}],"urls":["https://gist.github.com/okyfh/122c2d72e991a78c8af80a3af3be8671","https://gitlab.com/libtiff/libtiff/-/work_items/846"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52490","description":"An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c"}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"risk":0.47774999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data."},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"risk":0.47774999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data."},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"risk":0.47774999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data."},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"risk":0.47774999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data."},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-09","epss":0.00637,"percentile":0.48958}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"e9d28bf4fecb65b4","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/debian/libperl5.40@5.40.1-6%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"risk":0.47250000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"8d18bdf2d28de8c0","cpes":["cpe:2.3:a:perl:perl:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.40.1-6%2Bdeb13u1?arch=amd64&distro=debian-13.7","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"risk":0.47250000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"1ed310f43f3fc66d","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.40.1-6%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"risk":0.47250000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"ec18de78d97e6b78","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/debian/perl-modules-5.40@5.40.1-6%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"risk":0.47250000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-09","epss":0.0063,"percentile":0.48624}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-09","epss":0.005,"percentile":0.40998}],"risk":0.4525,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`."},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-09","epss":0.005,"percentile":0.40998}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-09","epss":0.005,"percentile":0.40998}],"risk":0.4525,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`."},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-09","epss":0.005,"percentile":0.40998}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-09","epss":0.005,"percentile":0.40998}],"risk":0.4525,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`."},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-09","epss":0.005,"percentile":0.40998}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"147b3d90c1d1a5d5","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-09","epss":0.00549,"percentile":0.44254}],"risk":0.430965,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-09","epss":0.00549,"percentile":0.44254}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80229","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-09","epss":0.00563,"percentile":0.45104}],"risk":0.42224999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations."},"relatedVulnerabilities":[{"id":"CVE-2026-80229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-09","epss":0.00563,"percentile":0.45104}],"urls":["https://curl.se/docs/CVE-2026-80229.html","https://curl.se/docs/CVE-2026-80229.json","https://hackerone.com/reports/3969255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80229","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-09","epss":0.00563,"percentile":0.45104}],"risk":0.42224999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations."},"relatedVulnerabilities":[{"id":"CVE-2026-80229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-09","epss":0.00563,"percentile":0.45104}],"urls":["https://curl.se/docs/CVE-2026-80229.html","https://curl.se/docs/CVE-2026-80229.json","https://hackerone.com/reports/3969255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80229","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-09","epss":0.00563,"percentile":0.45104}],"risk":0.42224999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations."},"relatedVulnerabilities":[{"id":"CVE-2026-80229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-09","epss":0.00563,"percentile":0.45104}],"urls":["https://curl.se/docs/CVE-2026-80229.html","https://curl.se/docs/CVE-2026-80229.json","https://hackerone.com/reports/3969255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"risk":0.40370000000000006,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables  B.2 or B.3 correctly: the latest Unicode codepoint attributes were used  instead of the specified Unicode 3.2.0. This behavior would cause  mismatches when processing domain names using IDNA 2003 (the \"idna\"  codec) and the in_table_b2() function of the \"stringprep\" module. This  only affects domain names containing characters that were not previously  registered or had their Unicode attributes such as case-folding  behavior updated since Unicode 3.2.0."},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"risk":0.40370000000000006,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables  B.2 or B.3 correctly: the latest Unicode codepoint attributes were used  instead of the specified Unicode 3.2.0. This behavior would cause  mismatches when processing domain names using IDNA 2003 (the \"idna\"  codec) and the in_table_b2() function of the \"stringprep\" module. This  only affects domain names containing characters that were not previously  registered or had their Unicode attributes such as case-folding  behavior updated since Unicode 3.2.0."},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-17084","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-17084","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"fixed","versions":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8","3.15.0rc2"],"available":[{"date":"2026-10-02","kind":"first-observed","version":"3.10.22"},{"date":"2026-10-02","kind":"first-observed","version":"3.11.17"},{"date":"2026-10-01","kind":"first-observed","version":"3.12.15"},{"date":"2026-10-01","kind":"first-observed","version":"3.13.16"},{"date":"2026-10-01","kind":"first-observed","version":"3.14.8"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0rc2"},{"date":"2026-09-09","kind":"first-observed","version":"3.15.0rc2"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"risk":0.40370000000000006,"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."},"relatedVulnerabilities":[]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"risk":0.40370000000000006,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables  B.2 or B.3 correctly: the latest Unicode codepoint attributes were used  instead of the specified Unicode 3.2.0. This behavior would cause  mismatches when processing domain names using IDNA 2003 (the \"idna\"  codec) and the in_table_b2() function of the \"stringprep\" module. This  only affects domain names containing characters that were not previously  registered or had their Unicode attributes such as case-folding  behavior updated since Unicode 3.2.0."},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"risk":0.40370000000000006,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables  B.2 or B.3 correctly: the latest Unicode codepoint attributes were used  instead of the specified Unicode 3.2.0. This behavior would cause  mismatches when processing domain names using IDNA 2003 (the \"idna\"  codec) and the in_table_b2() function of the \"stringprep\" module. This  only affects domain names containing characters that were not previously  registered or had their Unicode attributes such as case-folding  behavior updated since Unicode 3.2.0."},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-09","epss":0.00734,"percentile":0.53037}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8926","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8926","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-09","epss":0.00444,"percentile":0.36598}],"risk":0.40182000000000007,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user."},"relatedVulnerabilities":[{"id":"CVE-2026-8926","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-09","epss":0.00444,"percentile":0.36598}],"urls":["https://curl.se/docs/CVE-2026-8926.html","https://curl.se/docs/CVE-2026-8926.json","https://hackerone.com/reports/3735184"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8926","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8926","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-09","epss":0.00444,"percentile":0.36598}],"risk":0.40182000000000007,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user."},"relatedVulnerabilities":[{"id":"CVE-2026-8926","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-09","epss":0.00444,"percentile":0.36598}],"urls":["https://curl.se/docs/CVE-2026-8926.html","https://curl.se/docs/CVE-2026-8926.json","https://hackerone.com/reports/3735184"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8926","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8926","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-09","epss":0.00444,"percentile":0.36598}],"risk":0.40182000000000007,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user."},"relatedVulnerabilities":[{"id":"CVE-2026-8926","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-09","epss":0.00444,"percentile":0.36598}],"urls":["https://curl.se/docs/CVE-2026-8926.html","https://curl.se/docs/CVE-2026-8926.json","https://hackerone.com/reports/3735184"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40175999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40175999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40175999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"risk":0.40175999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-09","epss":0.00496,"percentile":0.40645}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-34152","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-34152","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"risk":0.40055,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."},"relatedVulnerabilities":[{"id":"CVE-2023-34152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"urls":["https://access.redhat.com/security/cve/CVE-2023-34152","https://bugzilla.redhat.com/show_bug.cgi?id=2210659","https://github.com/ImageMagick/ImageMagick/issues/6339","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-34152","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-34152","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"risk":0.40055,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."},"relatedVulnerabilities":[{"id":"CVE-2023-34152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"urls":["https://access.redhat.com/security/cve/CVE-2023-34152","https://bugzilla.redhat.com/show_bug.cgi?id=2210659","https://github.com/ImageMagick/ImageMagick/issues/6339","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-34152","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-34152","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"risk":0.40055,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."},"relatedVulnerabilities":[{"id":"CVE-2023-34152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"urls":["https://access.redhat.com/security/cve/CVE-2023-34152","https://bugzilla.redhat.com/show_bug.cgi?id=2210659","https://github.com/ImageMagick/ImageMagick/issues/6339","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-34152","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-34152","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"risk":0.40055,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."},"relatedVulnerabilities":[{"id":"CVE-2023-34152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"urls":["https://access.redhat.com/security/cve/CVE-2023-34152","https://bugzilla.redhat.com/show_bug.cgi?id=2210659","https://github.com/ImageMagick/ImageMagick/issues/6339","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-34152","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-34152","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"risk":0.40055,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."},"relatedVulnerabilities":[{"id":"CVE-2023-34152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-34152","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-34152","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-34152","date":"2026-10-09","epss":0.08011,"percentile":0.9464}],"urls":["https://access.redhat.com/security/cve/CVE-2023-34152","https://bugzilla.redhat.com/show_bug.cgi?id=2210659","https://github.com/ImageMagick/ImageMagick/issues/6339","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-34152","description":"A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"risk":0.39039,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.   Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"risk":0.39039,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.   Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-19445","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"fixed","versions":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8","3.15.0rc3"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"3.10.22"},{"date":"2026-10-08","kind":"first-observed","version":"3.11.17"},{"date":"2026-10-08","kind":"first-observed","version":"3.12.15"},{"date":"2026-10-08","kind":"first-observed","version":"3.13.16"},{"date":"2026-10-08","kind":"first-observed","version":"3.14.8"},{"date":"2026-10-08","kind":"first-observed","version":"3.15.0rc3"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"risk":0.39039,"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."},"relatedVulnerabilities":[]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"risk":0.39039,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.   Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"risk":0.39039,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.   Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-09","epss":0.00429,"percentile":0.35211}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"21dce3319984aa9d","cpes":["cpe:2.3:a:libheif-plugin-dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-dav1d","purl":"pkg:deb/debian/libheif-plugin-dav1d@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-dav1d/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-dav1d/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84384","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84384","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84384","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84384","date":"2026-10-09","epss":0.00517,"percentile":0.42225}],"risk":0.38775,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84384","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84384","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84384","date":"2026-10-09","epss":0.00517,"percentile":0.42225}],"urls":["https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84384","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"3f651db8f6ca23b6","cpes":["cpe:2.3:a:libheif-plugin-libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-libde265","purl":"pkg:deb/debian/libheif-plugin-libde265@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-libde265/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-libde265/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84384","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84384","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84384","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84384","date":"2026-10-09","epss":0.00517,"percentile":0.42225}],"risk":0.38775,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84384","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84384","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84384","date":"2026-10-09","epss":0.00517,"percentile":0.42225}],"urls":["https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84384","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"1d906423bc44bd58","cpes":["cpe:2.3:a:libheif1:libheif1:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/debian/libheif1@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84384","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84384","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84384","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84384","date":"2026-10-09","epss":0.00517,"percentile":0.42225}],"risk":0.38775,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84384","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84384","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84384","date":"2026-10-09","epss":0.00517,"percentile":0.42225}],"urls":["https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84384","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"21dce3319984aa9d","cpes":["cpe:2.3:a:libheif-plugin-dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-dav1d","purl":"pkg:deb/debian/libheif-plugin-dav1d@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-dav1d/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-dav1d/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-09","epss":0.00517,"percentile":0.42224}],"risk":0.38775,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-09","epss":0.00517,"percentile":0.42224}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"3f651db8f6ca23b6","cpes":["cpe:2.3:a:libheif-plugin-libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-libde265","purl":"pkg:deb/debian/libheif-plugin-libde265@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-libde265/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-libde265/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-09","epss":0.00517,"percentile":0.42224}],"risk":0.38775,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-09","epss":0.00517,"percentile":0.42224}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"1d906423bc44bd58","cpes":["cpe:2.3:a:libheif1:libheif1:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/debian/libheif1@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-09","epss":0.00517,"percentile":0.42224}],"risk":0.38775,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-09","epss":0.00517,"percentile":0.42224}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"risk":0.37448,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"risk":0.37448,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"risk":0.37448,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"risk":0.37448,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-09","epss":0.00496,"percentile":0.40691}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"risk":0.372555,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66041","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"risk":0.372555,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66041","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"risk":0.372555,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66041","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"risk":0.372555,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66041","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-09","epss":0.00487,"percentile":0.40061}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-09","epss":0.00494,"percentile":0.40533}],"risk":0.36556,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-09","epss":0.00494,"percentile":0.40533}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-09","epss":0.00494,"percentile":0.40533}],"risk":0.36556,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-09","epss":0.00494,"percentile":0.40533}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-09","epss":0.00494,"percentile":0.40533}],"risk":0.36556,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-09","epss":0.00494,"percentile":0.40533}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"a22d24d52d83d4d8","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.18-3.1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=cjson","type":"deb","version":"1.7.18-3.1+deb13u1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-29036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cjson","version":"1.7.18-3.1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-29036","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-10-09","epss":0.00444,"percentile":0.36602}],"risk":0.35964,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-29036","description":"cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification."},"relatedVulnerabilities":[{"id":"CVE-2026-29036","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-10-09","epss":0.00444,"percentile":0.36602}],"urls":["https://github.com/DaveGamble/cJSON","https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29036","description":"cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80255","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80255","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-09","epss":0.00478,"percentile":0.3938}],"risk":0.35850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host."},"relatedVulnerabilities":[{"id":"CVE-2026-80255","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-09","epss":0.00478,"percentile":0.3938}],"urls":["https://curl.se/docs/CVE-2026-80255.html","https://curl.se/docs/CVE-2026-80255.json","https://hackerone.com/reports/3972395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80255","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80255","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-09","epss":0.00478,"percentile":0.3938}],"risk":0.35850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host."},"relatedVulnerabilities":[{"id":"CVE-2026-80255","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-09","epss":0.00478,"percentile":0.3938}],"urls":["https://curl.se/docs/CVE-2026-80255.html","https://curl.se/docs/CVE-2026-80255.json","https://hackerone.com/reports/3972395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80255","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80255","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-09","epss":0.00478,"percentile":0.3938}],"risk":0.35850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host."},"relatedVulnerabilities":[{"id":"CVE-2026-80255","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-09","epss":0.00478,"percentile":0.3938}],"urls":["https://curl.se/docs/CVE-2026-80255.html","https://curl.se/docs/CVE-2026-80255.json","https://hackerone.com/reports/3972395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host."}]},{"artifact":{"id":"74e0d2fced48138b","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-74860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-74860","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-10-09","epss":0.00447,"percentile":0.36939}],"risk":0.35760000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."},"relatedVulnerabilities":[{"id":"CVE-2026-74860","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-10-09","epss":0.00447,"percentile":0.36939}],"urls":["https://access.redhat.com/errata/RHSA-2026:64463","https://access.redhat.com/errata/RHSA-2026:71585","https://access.redhat.com/errata/RHSA-2026:71586","https://access.redhat.com/errata/RHSA-2026:71641","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:79357","https://access.redhat.com/security/cve/CVE-2026-74860","https://bugzilla.redhat.com/show_bug.cgi?id=2529697"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"risk":0.356855,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation."},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"risk":0.356855,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation."},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"risk":0.356855,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation."},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-09","epss":0.00479,"percentile":0.39426}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"21dce3319984aa9d","cpes":["cpe:2.3:a:libheif-plugin-dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-dav1d","purl":"pkg:deb/debian/libheif-plugin-dav1d@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-dav1d/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-dav1d/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84444","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84444","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84444","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84444","date":"2026-10-09","epss":0.00478,"percentile":0.39295}],"risk":0.35611000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84444","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84444","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84444","date":"2026-10-09","epss":0.00478,"percentile":0.39295}],"urls":["https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"3f651db8f6ca23b6","cpes":["cpe:2.3:a:libheif-plugin-libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-libde265","purl":"pkg:deb/debian/libheif-plugin-libde265@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-libde265/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-libde265/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84444","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84444","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84444","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84444","date":"2026-10-09","epss":0.00478,"percentile":0.39295}],"risk":0.35611000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84444","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84444","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84444","date":"2026-10-09","epss":0.00478,"percentile":0.39295}],"urls":["https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"1d906423bc44bd58","cpes":["cpe:2.3:a:libheif1:libheif1:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/debian/libheif1@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84444","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84444","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84444","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84444","date":"2026-10-09","epss":0.00478,"percentile":0.39295}],"risk":0.35611000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84444","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84444","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84444","date":"2026-10-09","epss":0.00478,"percentile":0.39295}],"urls":["https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"614dd2dfa62b9595","cpes":["cpe:2.3:a:libldap2:libldap2:2.6.10\\+dfsg-1:*:*:*:*:*:*:*"],"name":"libldap2","purl":"pkg:deb/debian/libldap2@2.6.10%2Bdfsg-1?arch=amd64&distro=debian-13.7&upstream=openldap","type":"deb","version":"2.6.10+dfsg-1","language":"","licenses":["BSD-3-clause","BSD-3-clause-California","BSD-3-clause-variant","BSD-4-clause-California","Beerware","Expat","Expat-ISC","Expat-UNM","F5","FSF-unlimited","GPL-2","GPL-2+","GPL-3","GPL-3+","JCG","MIT-XC","NeoSoft-permissive","OpenLDAP-2.8","UMich","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libldap2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libldap2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-17740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openldap","version":"2.6.10+dfsg-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-17740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-17740","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17740","date":"2026-10-09","epss":0.07022,"percentile":0.94025}],"risk":0.3511,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation."},"relatedVulnerabilities":[{"id":"CVE-2017-17740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17740","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17740","date":"2026-10-09","epss":0.07022,"percentile":0.94025}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","http://www.openldap.org/its/index.cgi/Incoming?id=8759","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation."}]},{"artifact":{"id":"3f14f57e5d4140a1","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54873","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"risk":0.34650000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary.  Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer.  To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-54873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8ad59b627628fd53","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54873","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"risk":0.34650000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary.  Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer.  To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-54873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4b8c5bd5be8079b2","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54873","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"risk":0.34650000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary.  Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer.  To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-54873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-09","epss":0.00462,"percentile":0.38145}],"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"risk":0.345,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"risk":0.345,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"risk":0.345,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"risk":0.345,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-09","epss":0.0046,"percentile":0.37927}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"risk":0.344005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"risk":0.344005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-87910","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.15.0a1, < 3.15.0rc3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-87910","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.15.0a1, < 3.15.0rc3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"fixed","versions":["3.10.22","3.11.17","3.12.15","3.13.16","3.15.0rc3"],"available":[{"date":"2026-10-02","kind":"first-observed","version":"3.10.22"},{"date":"2026-10-02","kind":"first-observed","version":"3.11.17"},{"date":"2026-10-01","kind":"first-observed","version":"3.12.15"},{"date":"2026-10-01","kind":"first-observed","version":"3.13.16"},{"date":"2026-10-08","kind":"first-observed","version":"3.15.0rc3"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"risk":0.344005,"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."},"relatedVulnerabilities":[]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"risk":0.344005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"risk":0.344005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-09","epss":0.00643,"percentile":0.49301}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"21dce3319984aa9d","cpes":["cpe:2.3:a:libheif-plugin-dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-dav1d","purl":"pkg:deb/debian/libheif-plugin-dav1d@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-dav1d/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-dav1d/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84446","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84446","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84446","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84446","date":"2026-10-09","epss":0.00458,"percentile":0.37801}],"risk":0.34349999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84446","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84446","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84446","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84446","date":"2026-10-09","epss":0.00458,"percentile":0.37801}],"urls":["https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-xw34-mjcp-jqh8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84446","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"3f651db8f6ca23b6","cpes":["cpe:2.3:a:libheif-plugin-libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-libde265","purl":"pkg:deb/debian/libheif-plugin-libde265@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-libde265/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-libde265/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84446","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84446","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84446","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84446","date":"2026-10-09","epss":0.00458,"percentile":0.37801}],"risk":0.34349999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84446","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84446","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84446","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84446","date":"2026-10-09","epss":0.00458,"percentile":0.37801}],"urls":["https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-xw34-mjcp-jqh8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84446","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"1d906423bc44bd58","cpes":["cpe:2.3:a:libheif1:libheif1:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/debian/libheif1@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84446","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84446","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84446","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84446","date":"2026-10-09","epss":0.00458,"percentile":0.37801}],"risk":0.34349999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84446","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2."},"relatedVulnerabilities":[{"id":"CVE-2026-84446","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84446","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84446","date":"2026-10-09","epss":0.00458,"percentile":0.37801}],"urls":["https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-xw34-mjcp-jqh8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84446","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2."}]},{"artifact":{"id":"50f3e6307c72b0b7","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-09","epss":0.00666,"percentile":0.50355}],"risk":0.34299,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-09","epss":0.00666,"percentile":0.50355}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"e0cedc6dccd6380c","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-09","epss":0.00666,"percentile":0.50355}],"risk":0.34299,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-09","epss":0.00666,"percentile":0.50355}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"f8b8769b671bcd56","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-09","epss":0.00666,"percentile":0.50355}],"risk":0.34299,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-09","epss":0.00666,"percentile":0.50355}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"212a71fa16031fdf","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","layerID":"sha256:83fdf57f71f28b640f11d5072c284c81eadefc5ea538050fedcedba6149879bd","accessPath":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"risk":0.341955,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"7402a3d31bb024db","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"risk":0.341955,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"3f9378db54aaac9e","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"risk":0.341955,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"e96cb50e09a471e0","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"risk":0.341955,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-09","epss":0.00447,"percentile":0.36926}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"risk":0.33975000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"risk":0.33975000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"risk":0.33975000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"risk":0.33975000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"risk":0.33975000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-09","epss":0.00453,"percentile":0.37424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"8023e330605becba","cpes":["cpe:2.3:a:dirmngr:dirmngr:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*"],"name":"dirmngr","purl":"pkg:deb/debian/dirmngr@2.4.7-21%2Bdeb13u1%2Bb5?arch=amd64&distro=debian-13.7&upstream=gnupg2%402.4.7-21%2Bdeb13u1","type":"deb","version":"2.4.7-21+deb13u1+b5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dirmngr/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/dirmngr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/dirmngr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/dirmngr.list"},{"path":"/var/lib/dpkg/info/dirmngr.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/dirmngr.postinst"},{"path":"/var/lib/dpkg/info/dirmngr.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/dirmngr.postrm"},{"path":"/var/lib/dpkg/info/dirmngr.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/dirmngr.preinst"},{"path":"/var/lib/dpkg/info/dirmngr.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/dirmngr.prerm"}],"upstreams":[{"name":"gnupg2","version":"2.4.7-21+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnupg2","version":"2.4.7-21+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24882","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"risk":0.3396600000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."},"relatedVulnerabilities":[{"id":"CVE-2026-24882","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"urls":["https://dev.gnupg.org/T8045","https://www.openwall.com/lists/oss-security/2026/01/27/8","https://access.redhat.com/errata/RHSA-2026:2719","https://access.redhat.com/errata/RHSA-2026:2753","https://access.redhat.com/security/cve/CVE-2026-24882","https://bugzilla.redhat.com/show_bug.cgi?id=2433464","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."}]},{"artifact":{"id":"e708db6544496117","cpes":["cpe:2.3:a:gnupg:gnupg:2.4.7-21\\+deb13u1:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/debian/gnupg@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=gnupg2","type":"deb","version":"2.4.7-21+deb13u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gnupg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnupg2","version":"2.4.7-21+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24882","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"risk":0.3396600000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."},"relatedVulnerabilities":[{"id":"CVE-2026-24882","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"urls":["https://dev.gnupg.org/T8045","https://www.openwall.com/lists/oss-security/2026/01/27/8","https://access.redhat.com/errata/RHSA-2026:2719","https://access.redhat.com/errata/RHSA-2026:2753","https://access.redhat.com/security/cve/CVE-2026-24882","https://bugzilla.redhat.com/show_bug.cgi?id=2433464","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."}]},{"artifact":{"id":"aecb683b9f0b939d","cpes":["cpe:2.3:a:gnupg-l10n:gnupg-l10n:2.4.7-21\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-l10n:gnupg_l10n:2.4.7-21\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg-l10n:2.4.7-21\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg_l10n:2.4.7-21\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-l10n:2.4.7-21\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_l10n:2.4.7-21\\+deb13u1:*:*:*:*:*:*:*"],"name":"gnupg-l10n","purl":"pkg:deb/debian/gnupg-l10n@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=gnupg2","type":"deb","version":"2.4.7-21+deb13u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-l10n/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/gnupg-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gnupg-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gnupg-l10n.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnupg2","version":"2.4.7-21+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24882","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"risk":0.3396600000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."},"relatedVulnerabilities":[{"id":"CVE-2026-24882","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"urls":["https://dev.gnupg.org/T8045","https://www.openwall.com/lists/oss-security/2026/01/27/8","https://access.redhat.com/errata/RHSA-2026:2719","https://access.redhat.com/errata/RHSA-2026:2753","https://access.redhat.com/security/cve/CVE-2026-24882","https://bugzilla.redhat.com/show_bug.cgi?id=2433464","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."}]},{"artifact":{"id":"4c977c82951f693d","cpes":["cpe:2.3:a:gpg:gpg:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*"],"name":"gpg","purl":"pkg:deb/debian/gpg@2.4.7-21%2Bdeb13u1%2Bb5?arch=amd64&distro=debian-13.7&upstream=gnupg2%402.4.7-21%2Bdeb13u1","type":"deb","version":"2.4.7-21+deb13u1+b5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/gpg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg.list"},{"path":"/var/lib/dpkg/info/gpg.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg.postinst"},{"path":"/var/lib/dpkg/info/gpg.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg.postrm"}],"upstreams":[{"name":"gnupg2","version":"2.4.7-21+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnupg2","version":"2.4.7-21+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24882","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"risk":0.3396600000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."},"relatedVulnerabilities":[{"id":"CVE-2026-24882","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"urls":["https://dev.gnupg.org/T8045","https://www.openwall.com/lists/oss-security/2026/01/27/8","https://access.redhat.com/errata/RHSA-2026:2719","https://access.redhat.com/errata/RHSA-2026:2753","https://access.redhat.com/security/cve/CVE-2026-24882","https://bugzilla.redhat.com/show_bug.cgi?id=2433464","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."}]},{"artifact":{"id":"4ac4029721ccdd3d","cpes":["cpe:2.3:a:gpg-agent:gpg-agent:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-agent:gpg_agent:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg-agent:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg_agent:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-agent:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_agent:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*"],"name":"gpg-agent","purl":"pkg:deb/debian/gpg-agent@2.4.7-21%2Bdeb13u1%2Bb5?arch=amd64&distro=debian-13.7&upstream=gnupg2%402.4.7-21%2Bdeb13u1","type":"deb","version":"2.4.7-21+deb13u1+b5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-agent/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/gpg-agent/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg-agent.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg-agent.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg-agent.list"},{"path":"/var/lib/dpkg/info/gpg-agent.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg-agent.postinst"},{"path":"/var/lib/dpkg/info/gpg-agent.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpg-agent.postrm"}],"upstreams":[{"name":"gnupg2","version":"2.4.7-21+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnupg2","version":"2.4.7-21+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24882","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"risk":0.3396600000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."},"relatedVulnerabilities":[{"id":"CVE-2026-24882","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"urls":["https://dev.gnupg.org/T8045","https://www.openwall.com/lists/oss-security/2026/01/27/8","https://access.redhat.com/errata/RHSA-2026:2719","https://access.redhat.com/errata/RHSA-2026:2753","https://access.redhat.com/security/cve/CVE-2026-24882","https://bugzilla.redhat.com/show_bug.cgi?id=2433464","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."}]},{"artifact":{"id":"d5ed9e46902b0669","cpes":["cpe:2.3:a:gpgconf:gpgconf:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*"],"name":"gpgconf","purl":"pkg:deb/debian/gpgconf@2.4.7-21%2Bdeb13u1%2Bb5?arch=amd64&distro=debian-13.7&upstream=gnupg2%402.4.7-21%2Bdeb13u1","type":"deb","version":"2.4.7-21+deb13u1+b5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgconf/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/gpgconf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpgconf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpgconf.list"}],"upstreams":[{"name":"gnupg2","version":"2.4.7-21+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnupg2","version":"2.4.7-21+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24882","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"risk":0.3396600000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."},"relatedVulnerabilities":[{"id":"CVE-2026-24882","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"urls":["https://dev.gnupg.org/T8045","https://www.openwall.com/lists/oss-security/2026/01/27/8","https://access.redhat.com/errata/RHSA-2026:2719","https://access.redhat.com/errata/RHSA-2026:2753","https://access.redhat.com/security/cve/CVE-2026-24882","https://bugzilla.redhat.com/show_bug.cgi?id=2433464","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."}]},{"artifact":{"id":"f63041d36162ac8a","cpes":["cpe:2.3:a:gpgsm:gpgsm:2.4.7-21\\+deb13u1\\+b5:*:*:*:*:*:*:*"],"name":"gpgsm","purl":"pkg:deb/debian/gpgsm@2.4.7-21%2Bdeb13u1%2Bb5?arch=amd64&distro=debian-13.7&upstream=gnupg2%402.4.7-21%2Bdeb13u1","type":"deb","version":"2.4.7-21+deb13u1+b5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgsm/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/gpgsm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpgsm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/gpgsm.list"}],"upstreams":[{"name":"gnupg2","version":"2.4.7-21+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnupg2","version":"2.4.7-21+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24882","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"risk":0.3396600000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."},"relatedVulnerabilities":[{"id":"CVE-2026-24882","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-24882","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24882","date":"2026-10-09","epss":0.00444,"percentile":0.3666}],"urls":["https://dev.gnupg.org/T8045","https://www.openwall.com/lists/oss-security/2026/01/27/8","https://access.redhat.com/errata/RHSA-2026:2719","https://access.redhat.com/errata/RHSA-2026:2753","https://access.redhat.com/security/cve/CVE-2026-24882","https://bugzilla.redhat.com/show_bug.cgi?id=2433464","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."}]},{"artifact":{"id":"3747a63ebad1c96d","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-09","epss":0.00588,"percentile":0.4649}],"risk":0.33809999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-09","epss":0.00588,"percentile":0.4649}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"risk":0.3366,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"risk":0.3366,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"risk":0.3366,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"risk":0.3366,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-09","epss":0.0044,"percentile":0.36247}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"e9d28bf4fecb65b4","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/debian/libperl5.40@5.40.1-6%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"risk":0.33599999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.  _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.  A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"8d18bdf2d28de8c0","cpes":["cpe:2.3:a:perl:perl:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.40.1-6%2Bdeb13u1?arch=amd64&distro=debian-13.7","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"risk":0.33599999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.  _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.  A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"1ed310f43f3fc66d","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.40.1-6%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"risk":0.33599999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.  _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.  A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"ec18de78d97e6b78","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/debian/perl-modules-5.40@5.40.1-6%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"risk":0.33599999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.  _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.  A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-09","epss":0.00448,"percentile":0.37018}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"74e0d2fced48138b","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6653","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6653","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-10-09","epss":0.00355,"percentile":0.27228}],"risk":0.33370000000000005,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6653","description":"Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling."},"relatedVulnerabilities":[{"id":"CVE-2026-6653","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-10-09","epss":0.00355,"percentile":0.27228}],"urls":["https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6653","description":"Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling."}]},{"artifact":{"id":"147b3d90c1d1a5d5","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-09","epss":0.00403,"percentile":0.32524}],"risk":0.32642999999999994,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-09","epss":0.00403,"percentile":0.32524}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"f5152615a12aeb3d","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"5c8cb5d5c2e5df78","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"bd4b70ba8c48d583","cpes":["cpe:2.3:a:liblastlog2-2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2-2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"liblastlog2-2","purl":"pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblastlog2-2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/liblastlog2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblastlog2-2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/liblastlog2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"cfe9c78846143096","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"a6e51e84db754048","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"faedc3139e685610","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"9db9d188fa9e89fc","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:4.16.0-2+really2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"bd55752b0f187487","cpes":["cpe:2.3:a:mount:mount:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"166978fa81223e72","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"risk":0.319815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-09","epss":0.00621,"percentile":0.48196}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"risk":0.3197,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"risk":0.3197,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"risk":0.3197,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"risk":0.3197,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-09","epss":0.00556,"percentile":0.44665}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"daa1f8dfeee1793b","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"c5f7e9443917908e","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"0d7d9accbe1a77b1","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"dcbb71b238b6d3d6","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-09","epss":0.00424,"percentile":0.34714}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.13.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-12781","versionConstraint":"< 3.13.10||>= 3.14.0, < 3.14.1||>= 3.15.0a1, < 3.15.0a2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.13.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-12781","versionConstraint":"< 3.13.10||>= 3.14.0, < 3.14.1||>= 3.15.0a1, < 3.15.0a2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"fixed","versions":["3.13.10","3.14.1","3.15.0a2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.13.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.1"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a2"},{"date":"2026-06-18","kind":"first-observed","version":"3.13.10"},{"date":"2026-06-18","kind":"first-observed","version":"3.14.1"},{"date":"2026-06-18","kind":"first-observed","version":"3.15.0a2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"risk":0.30726,"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."},"relatedVulnerabilities":[]},{"artifact":{"id":"3f14f57e5d4140a1","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-09","epss":0.0039,"percentile":0.3109}],"risk":0.30615,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly.  Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region.  CWE: CWE-125: Out-of-bounds Read  Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.  The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer.  Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build.  The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead.  FIPS impact: no The affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-09","epss":0.0039,"percentile":0.3109}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"8ad59b627628fd53","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-09","epss":0.0039,"percentile":0.3109}],"risk":0.30615,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly.  Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region.  CWE: CWE-125: Out-of-bounds Read  Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.  The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer.  Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build.  The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead.  FIPS impact: no The affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-09","epss":0.0039,"percentile":0.3109}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"4b8c5bd5be8079b2","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-09","epss":0.0039,"percentile":0.3109}],"risk":0.30615,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly.  Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region.  CWE: CWE-125: Out-of-bounds Read  Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.  The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer.  Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build.  The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead.  FIPS impact: no The affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-09","epss":0.0039,"percentile":0.3109}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-09","epss":0.00408,"percentile":0.33021}],"risk":0.30600000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.  When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-09","epss":0.00408,"percentile":0.33021}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-09","epss":0.00408,"percentile":0.33021}],"risk":0.30600000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.  When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-09","epss":0.00408,"percentile":0.33021}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-09","epss":0.00408,"percentile":0.33021}],"risk":0.30600000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.  When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-09","epss":0.00408,"percentile":0.33021}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"risk":0.302755,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped.   This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.   If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.   Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"risk":0.302755,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped.   This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.   If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.   Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-19553","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"fixed","versions":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8","3.15.0rc3"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"3.10.22"},{"date":"2026-10-08","kind":"first-observed","version":"3.11.17"},{"date":"2026-10-08","kind":"first-observed","version":"3.12.15"},{"date":"2026-10-08","kind":"first-observed","version":"3.13.16"},{"date":"2026-10-08","kind":"first-observed","version":"3.14.8"},{"date":"2026-10-08","kind":"first-observed","version":"3.15.0rc3"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"risk":0.302755,"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."},"relatedVulnerabilities":[]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"risk":0.302755,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped.   This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.   If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.   Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"risk":0.302755,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped.   This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.   If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.   Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-09","epss":0.00401,"percentile":0.32294}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"3f14f57e5d4140a1","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84784","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84784","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-09","epss":0.00403,"percentile":0.32538}],"risk":0.30225,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use.  Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay).  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired.  The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame.  Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth.  [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-84784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-09","epss":0.00403,"percentile":0.32538}],"urls":["https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a","https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806","https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f","https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8ad59b627628fd53","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84784","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84784","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-09","epss":0.00403,"percentile":0.32538}],"risk":0.30225,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use.  Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay).  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired.  The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame.  Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth.  [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-84784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-09","epss":0.00403,"percentile":0.32538}],"urls":["https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a","https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806","https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f","https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4b8c5bd5be8079b2","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84784","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84784","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-09","epss":0.00403,"percentile":0.32538}],"risk":0.30225,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use.  Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay).  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired.  The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame.  Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth.  [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-84784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-09","epss":0.00403,"percentile":0.32538}],"urls":["https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a","https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806","https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f","https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-12064","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-09","epss":0.00399,"percentile":0.32113}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error."},"relatedVulnerabilities":[{"id":"CVE-2026-12064","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-09","epss":0.00399,"percentile":0.32113}],"urls":["https://curl.se/docs/CVE-2026-12064.html","https://curl.se/docs/CVE-2026-12064.json","https://hackerone.com/reports/3797526"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-12064","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-09","epss":0.00399,"percentile":0.32113}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error."},"relatedVulnerabilities":[{"id":"CVE-2026-12064","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-09","epss":0.00399,"percentile":0.32113}],"urls":["https://curl.se/docs/CVE-2026-12064.html","https://curl.se/docs/CVE-2026-12064.json","https://hackerone.com/reports/3797526"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-12064","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-09","epss":0.00399,"percentile":0.32113}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error."},"relatedVulnerabilities":[{"id":"CVE-2026-12064","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-09","epss":0.00399,"percentile":0.32113}],"urls":["https://curl.se/docs/CVE-2026-12064.html","https://curl.se/docs/CVE-2026-12064.json","https://hackerone.com/reports/3797526"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"risk":0.2987,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"risk":0.2987,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"risk":0.2987,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"risk":0.2987,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-09","epss":0.0058,"percentile":0.46045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"1f32975dfd37be95","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"cb7fdbb7b6a04bdc","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"eb5873c5c35e21b8","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"1c6c7728b37b94de","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-09","epss":0.005,"percentile":0.40942}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8932","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-09","epss":0.00396,"percentile":0.31769}],"risk":0.297,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.  libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key."},"relatedVulnerabilities":[{"id":"CVE-2026-8932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-09","epss":0.00396,"percentile":0.31769}],"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8932","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-09","epss":0.00396,"percentile":0.31769}],"risk":0.297,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.  libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key."},"relatedVulnerabilities":[{"id":"CVE-2026-8932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-09","epss":0.00396,"percentile":0.31769}],"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8932","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-09","epss":0.00396,"percentile":0.31769}],"risk":0.297,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.  libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key."},"relatedVulnerabilities":[{"id":"CVE-2026-8932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-09","epss":0.00396,"percentile":0.31769}],"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"risk":0.293035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.     This behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.     The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64  alphabet they are expecting or verify that their application would not be  affected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"risk":0.293035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.     This behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.     The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64  alphabet they are expecting or verify that their application would not be  affected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"risk":0.293035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.     This behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.     The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64  alphabet they are expecting or verify that their application would not be  affected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"risk":0.293035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.     This behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.     The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64  alphabet they are expecting or verify that their application would not be  affected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-09","epss":0.00569,"percentile":0.45451}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"risk":0.292805,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).  Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`)."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"risk":0.292805,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).  Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`)."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"risk":0.292805,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).  Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`)."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-09","epss":0.00373,"percentile":0.29236}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5435","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5435","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-09","epss":0.00394,"percentile":0.31544}],"risk":0.29156,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."},"relatedVulnerabilities":[{"id":"CVE-2026-5435","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-09","epss":0.00394,"percentile":0.31544}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34033","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5435","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5435","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-09","epss":0.00394,"percentile":0.31544}],"risk":0.29156,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."},"relatedVulnerabilities":[{"id":"CVE-2026-5435","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-09","epss":0.00394,"percentile":0.31544}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34033","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"risk":0.29040000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.  Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.  Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"risk":0.29040000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.  Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.  Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-15806","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-15806","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"fixed","versions":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8","3.15.0rc2"],"available":[{"date":"2026-10-02","kind":"first-observed","version":"3.10.22"},{"date":"2026-10-02","kind":"first-observed","version":"3.11.17"},{"date":"2026-10-01","kind":"first-observed","version":"3.12.15"},{"date":"2026-10-01","kind":"first-observed","version":"3.13.16"},{"date":"2026-10-01","kind":"first-observed","version":"3.14.8"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0rc2"},{"date":"2026-09-09","kind":"first-observed","version":"3.15.0rc2"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"risk":0.29040000000000005,"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."},"relatedVulnerabilities":[]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"risk":0.29040000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.  Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.  Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"risk":0.29040000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.  Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.  Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-09","epss":0.00528,"percentile":0.42975}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"risk":0.28908,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"risk":0.28908,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"risk":0.28908,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"risk":0.28908,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-09","epss":0.00396,"percentile":0.31706}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"50f3e6307c72b0b7","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-09","epss":0.00561,"percentile":0.45007}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-09","epss":0.00561,"percentile":0.45007}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"e0cedc6dccd6380c","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-09","epss":0.00561,"percentile":0.45007}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-09","epss":0.00561,"percentile":0.45007}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"f8b8769b671bcd56","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-09","epss":0.00561,"percentile":0.45007}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-09","epss":0.00561,"percentile":0.45007}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-09","epss":0.05757,"percentile":0.92888}],"risk":0.28785000000000005,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-09","epss":0.05757,"percentile":0.92888}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-09","epss":0.05757,"percentile":0.92888}],"risk":0.28785000000000005,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-09","epss":0.05757,"percentile":0.92888}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"8a1ec6d9372df578","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg\\+really1.3.1-1\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64&distro=debian-13.7&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1","type":"deb","version":"1:1.3.dfsg+really1.3.1-1+b1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-09","epss":0.00356,"percentile":0.2726}],"risk":0.28124,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-09","epss":0.00356,"percentile":0.2726}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"e2c0cfe2f366c89d","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.7.0-3\\+deb13u3:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64&distro=debian-13.7&upstream=tiff","type":"deb","version":"4.7.0-3+deb13u3","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16232","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tiff","version":"4.7.0-3+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-16232","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16232","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16232","date":"2026-10-09","epss":0.05584,"percentile":0.92694}],"risk":0.2792,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16232","description":"LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue"},"relatedVulnerabilities":[{"id":"CVE-2017-16232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16232","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16232","date":"2026-10-09","epss":0.05584,"percentile":0.92694}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html","http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html","http://seclists.org/fulldisclosure/2018/Dec/32","http://seclists.org/fulldisclosure/2018/Dec/47","http://www.openwall.com/lists/oss-security/2017/11/01/11","http://www.openwall.com/lists/oss-security/2017/11/01/3","http://www.openwall.com/lists/oss-security/2017/11/01/7","http://www.openwall.com/lists/oss-security/2017/11/01/8","http://www.securityfocus.com/bid/101696"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16232","description":"LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue"}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"risk":0.27825,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"risk":0.27825,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"risk":0.27825,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-09","epss":0.00371,"percentile":0.29045}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"a22d24d52d83d4d8","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.18-3.1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=cjson","type":"deb","version":"1.7.18-3.1+deb13u1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87933","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cjson","version":"1.7.18-3.1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87933","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-10-09","epss":0.00527,"percentile":0.42896}],"risk":0.276675,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87933","description":"A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance."},"relatedVulnerabilities":[{"id":"CVE-2026-87933","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-10-09","epss":0.00527,"percentile":0.42896}],"urls":["https://github.com/DaveGamble/cJSON/","https://github.com/DaveGamble/cJSON/issues/1060","https://github.com/DaveGamble/cJSON/pull/1065","https://vuldb.com/cve/CVE-2026-87933","https://vuldb.com/submit/911136","https://vuldb.com/vuln/401815","https://vuldb.com/vuln/401815/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87933","description":"A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance."}]},{"artifact":{"id":"8a928cc6733b8d4c","cpes":["cpe:2.3:a:gcc-14-base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14-base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*"],"name":"gcc-14-base","purl":"pkg:deb/debian/gcc-14-base@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/gcc-14-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-14-base:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/gcc-14-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"4aef59838e786012","cpes":["cpe:2.3:a:libatomic1:libatomic1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"2338ed612a82adf3","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"71d32d5417d636ce","cpes":["cpe:2.3:a:libgomp1:libgomp1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/debian/libgomp1@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"7dc961cf921ecd08","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:14.2.0-19:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-09","epss":0.00363,"percentile":0.2815}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"risk":0.27135,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"risk":0.27135,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"risk":0.27135,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"risk":0.27135,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-09","epss":0.00335,"percentile":0.2484}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"99df015a43949852","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-61915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-61915","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61915","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-61915","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-61915","date":"2026-10-09","epss":0.00462,"percentile":0.38157}],"risk":0.27026999999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15."},"relatedVulnerabilities":[{"id":"CVE-2025-61915","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61915","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-61915","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-61915","date":"2026-10-09","epss":0.00462,"percentile":0.38157}],"urls":["https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0","https://github.com/OpenPrinting/cups/releases/tag/v2.4.15","https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc","http://www.openwall.com/lists/oss-security/2025/11/27/5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-19672","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.12.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-19672","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.17||>= 3.12.0, < 3.12.15||>= 3.13.0, < 3.13.16||>= 3.14.0, < 3.14.8||>= 3.15.0a1, < 3.15.0rc2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"fixed","versions":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8","3.15.0rc2"],"available":[{"date":"2026-10-02","kind":"first-observed","version":"3.10.22"},{"date":"2026-10-02","kind":"first-observed","version":"3.11.17"},{"date":"2026-10-02","kind":"first-observed","version":"3.12.15"},{"date":"2026-10-02","kind":"first-observed","version":"3.13.16"},{"date":"2026-10-02","kind":"first-observed","version":"3.14.8"},{"date":"2026-10-02","kind":"first-observed","version":"3.15.0rc2"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-09","epss":0.00472,"percentile":0.38869}],"risk":0.26668,"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."},"relatedVulnerabilities":[]},{"artifact":{"id":"614dd2dfa62b9595","cpes":["cpe:2.3:a:libldap2:libldap2:2.6.10\\+dfsg-1:*:*:*:*:*:*:*"],"name":"libldap2","purl":"pkg:deb/debian/libldap2@2.6.10%2Bdfsg-1?arch=amd64&distro=debian-13.7&upstream=openldap","type":"deb","version":"2.6.10+dfsg-1","language":"","licenses":["BSD-3-clause","BSD-3-clause-California","BSD-3-clause-variant","BSD-4-clause-California","Beerware","Expat","Expat-ISC","Expat-UNM","F5","FSF-unlimited","GPL-2","GPL-2+","GPL-3","GPL-3+","JCG","MIT-XC","NeoSoft-permissive","OpenLDAP-2.8","UMich","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libldap2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libldap2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openldap","version":"2.6.10+dfsg-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2015-3276","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2015-3276","date":"2026-10-09","epss":0.05269,"percentile":0.92357}],"risk":0.26345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-3276","description":"The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors."},"relatedVulnerabilities":[{"id":"CVE-2015-3276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-3276","date":"2026-10-09","epss":0.05269,"percentile":0.92357}],"urls":["http://rhn.redhat.com/errata/RHSA-2015-2131.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securitytracker.com/id/1034221","https://bugzilla.redhat.com/show_bug.cgi?id=1238322"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3276","description":"The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-15607","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-15607","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"risk":0.25850000000000006,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."},"relatedVulnerabilities":[{"id":"CVE-2018-15607","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"urls":["http://www.securityfocus.com/bid/105137","https://github.com/ImageMagick/ImageMagick/issues/1255","https://usn.ubuntu.com/4034-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15607","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-15607","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"risk":0.25850000000000006,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."},"relatedVulnerabilities":[{"id":"CVE-2018-15607","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"urls":["http://www.securityfocus.com/bid/105137","https://github.com/ImageMagick/ImageMagick/issues/1255","https://usn.ubuntu.com/4034-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15607","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-15607","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"risk":0.25850000000000006,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."},"relatedVulnerabilities":[{"id":"CVE-2018-15607","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"urls":["http://www.securityfocus.com/bid/105137","https://github.com/ImageMagick/ImageMagick/issues/1255","https://usn.ubuntu.com/4034-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15607","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-15607","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"risk":0.25850000000000006,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."},"relatedVulnerabilities":[{"id":"CVE-2018-15607","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"urls":["http://www.securityfocus.com/bid/105137","https://github.com/ImageMagick/ImageMagick/issues/1255","https://usn.ubuntu.com/4034-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15607","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-15607","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"risk":0.25850000000000006,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."},"relatedVulnerabilities":[{"id":"CVE-2018-15607","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15607","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-15607","date":"2026-10-09","epss":0.0517,"percentile":0.92241}],"urls":["http://www.securityfocus.com/bid/105137","https://github.com/ImageMagick/ImageMagick/issues/1255","https://usn.ubuntu.com/4034-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15607","description":"In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file."}]},{"artifact":{"id":"cbe0cc0bd7937bcc","cpes":["cpe:2.3:a:python-fsspec:python-fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python-fsspec:python_fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_fsspec:python-fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_fsspec:python_fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fsspec:python-fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fsspec:python_fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python-fsspec:fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_fsspec:fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fsspec:fsspec:2026.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:fsspec:2026.1.0:*:*:*:*:*:*:*"],"name":"fsspec","purl":"pkg:pypi/fsspec@2026.1.0","type":"python","version":"2026.1.0","language":"python","licenses":["BSD-3-Clause"],"locations":[{"path":"/opt/venv/lib/python3.12/site-packages/fsspec-2026.1.0.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/fsspec-2026.1.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/opt/venv/lib/python3.12/site-packages/fsspec-2026.1.0.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/fsspec-2026.1.0.dist-info/RECORD","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2026.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-27vj-qcqg-25rc","versionConstraint":">=0.9.0,<2026.6.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"fsspec","version":"2026.1.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-27vj-qcqg-25rc","fix":{"state":"fixed","versions":["2026.6.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"2026.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104851","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104851","cwe":"CWE-1336","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104851","date":"2026-10-09","epss":0.00317,"percentile":0.22689}],"risk":0.25835500000000006,"urls":["https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc","https://nvd.nist.gov/vuln/detail/CVE-2026-104851","https://github.com/fsspec/filesystem_spec/pull/2029","https://github.com/fsspec/filesystem_spec/pull/2039","https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c","https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8","https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-27vj-qcqg-25rc","description":"fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution"},"relatedVulnerabilities":[{"id":"CVE-2026-104851","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104851","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104851","cwe":"CWE-1336","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104851","date":"2026-10-09","epss":0.00317,"percentile":0.22689}],"urls":["https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c","https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8","https://github.com/fsspec/filesystem_spec/pull/2029","https://github.com/fsspec/filesystem_spec/pull/2039","https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0","https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104851","description":"fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0."}]},{"artifact":{"id":"3747a63ebad1c96d","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39327","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-39327","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39327","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39327","date":"2026-10-09","epss":0.00555,"percentile":0.44598}],"risk":0.258075,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-39327","description":"A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal."},"relatedVulnerabilities":[{"id":"CVE-2023-39327","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39327","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39327","date":"2026-10-09","epss":0.00555,"percentile":0.44598}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39327","https://bugzilla.redhat.com/show_bug.cgi?id=2295812","https://github.com/uclouvain/openjpeg/issues/1472"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39327","description":"A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal."}]},{"artifact":{"id":"daa1f8dfeee1793b","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"c5f7e9443917908e","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"0d7d9accbe1a77b1","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"dcbb71b238b6d3d6","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-09","epss":0.00521,"percentile":0.42454}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"a22d24d52d83d4d8","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.18-3.1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=cjson","type":"deb","version":"1.7.18-3.1+deb13u1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cjson","version":"1.7.18-3.1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-67217","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-10-09","epss":0.00433,"percentile":0.35612}],"risk":0.257635,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."},"relatedVulnerabilities":[{"id":"CVE-2026-67217","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-10-09","epss":0.00433,"percentile":0.35612}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L887-L948","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."}]},{"artifact":{"id":"df23c4764411e8ea","cpes":["cpe:2.3:a:pip_developers_\\<distutils_sig_project:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:25.0.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@25.0.1","type":"python","version":"25.0.1","language":"python","licenses":["MIT"],"locations":[{"path":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"26.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wf93-45jw-7689","versionConstraint":"<26.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"25.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-wf93-45jw-7689","fix":{"state":"fixed","versions":["26.1.2"],"available":[{"date":"2026-07-09","kind":"first-observed","version":"26.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":4.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8643","date":"2026-10-09","epss":0.00466,"percentile":0.38381}],"risk":0.257465,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8643","https://github.com/pypa/pip/pull/14000","https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ","http://www.openwall.com/lists/oss-security/2026/06/01/5","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json","https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml","https://bugzilla.redhat.com/show_bug.cgi?id=2460927","https://access.redhat.com/security/cve/CVE-2026-8643","https://access.redhat.com/errata/RHSA-2026:36315","https://access.redhat.com/errata/RHSA-2026:36193","https://access.redhat.com/errata/RHSA-2026:34891","https://access.redhat.com/errata/RHSA-2026:34780","https://access.redhat.com/errata/RHSA-2026:34778","https://access.redhat.com/errata/RHSA-2026:34777","https://access.redhat.com/errata/RHSA-2026:34776","https://access.redhat.com/errata/RHSA-2026:34775","https://access.redhat.com/errata/RHSA-2026:34774","https://access.redhat.com/errata/RHSA-2026:34773","https://access.redhat.com/errata/RHSA-2026:34772","https://access.redhat.com/errata/RHSA-2026:34765","https://access.redhat.com/errata/RHSA-2026:34760","https://access.redhat.com/errata/RHSA-2026:34758","https://access.redhat.com/errata/RHSA-2026:34756","https://access.redhat.com/errata/RHSA-2026:34752","https://access.redhat.com/errata/RHSA-2026:34750","https://access.redhat.com/errata/RHSA-2026:34749","https://access.redhat.com/errata/RHSA-2026:34748","https://access.redhat.com/errata/RHSA-2026:34741","https://access.redhat.com/errata/RHSA-2026:34740","https://access.redhat.com/errata/RHSA-2026:34739","https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37283"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wf93-45jw-7689","description":"pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory"},"relatedVulnerabilities":[{"id":"CVE-2026-8643","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8643","date":"2026-10-09","epss":0.00466,"percentile":0.38381}],"urls":["https://github.com/pypa/pip/pull/14000","https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/","http://www.openwall.com/lists/oss-security/2026/06/01/5","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:34739","https://access.redhat.com/errata/RHSA-2026:34740","https://access.redhat.com/errata/RHSA-2026:34741","https://access.redhat.com/errata/RHSA-2026:34748","https://access.redhat.com/errata/RHSA-2026:34749","https://access.redhat.com/errata/RHSA-2026:34750","https://access.redhat.com/errata/RHSA-2026:34752","https://access.redhat.com/errata/RHSA-2026:34756","https://access.redhat.com/errata/RHSA-2026:34758","https://access.redhat.com/errata/RHSA-2026:34760","https://access.redhat.com/errata/RHSA-2026:34765","https://access.redhat.com/errata/RHSA-2026:34772","https://access.redhat.com/errata/RHSA-2026:34773","https://access.redhat.com/errata/RHSA-2026:34774","https://access.redhat.com/errata/RHSA-2026:34775","https://access.redhat.com/errata/RHSA-2026:34776","https://access.redhat.com/errata/RHSA-2026:34777","https://access.redhat.com/errata/RHSA-2026:34778","https://access.redhat.com/errata/RHSA-2026:34780","https://access.redhat.com/errata/RHSA-2026:34891","https://access.redhat.com/errata/RHSA-2026:36193","https://access.redhat.com/errata/RHSA-2026:36315","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37283","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42144","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56347","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-8643","https://bugzilla.redhat.com/show_bug.cgi?id=2460927","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8643","description":"pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory."}]},{"artifact":{"id":"b07d834d26c4749b","cpes":["cpe:2.3:a:pip_developers_\\<distutils_sig_project:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:25.0.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@25.0.1","type":"python","version":"25.0.1","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"26.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wf93-45jw-7689","versionConstraint":"<26.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"25.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-wf93-45jw-7689","fix":{"state":"fixed","versions":["26.1.2"],"available":[{"date":"2026-07-09","kind":"first-observed","version":"26.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":4.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8643","date":"2026-10-09","epss":0.00466,"percentile":0.38381}],"risk":0.257465,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8643","https://github.com/pypa/pip/pull/14000","https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ","http://www.openwall.com/lists/oss-security/2026/06/01/5","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json","https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml","https://bugzilla.redhat.com/show_bug.cgi?id=2460927","https://access.redhat.com/security/cve/CVE-2026-8643","https://access.redhat.com/errata/RHSA-2026:36315","https://access.redhat.com/errata/RHSA-2026:36193","https://access.redhat.com/errata/RHSA-2026:34891","https://access.redhat.com/errata/RHSA-2026:34780","https://access.redhat.com/errata/RHSA-2026:34778","https://access.redhat.com/errata/RHSA-2026:34777","https://access.redhat.com/errata/RHSA-2026:34776","https://access.redhat.com/errata/RHSA-2026:34775","https://access.redhat.com/errata/RHSA-2026:34774","https://access.redhat.com/errata/RHSA-2026:34773","https://access.redhat.com/errata/RHSA-2026:34772","https://access.redhat.com/errata/RHSA-2026:34765","https://access.redhat.com/errata/RHSA-2026:34760","https://access.redhat.com/errata/RHSA-2026:34758","https://access.redhat.com/errata/RHSA-2026:34756","https://access.redhat.com/errata/RHSA-2026:34752","https://access.redhat.com/errata/RHSA-2026:34750","https://access.redhat.com/errata/RHSA-2026:34749","https://access.redhat.com/errata/RHSA-2026:34748","https://access.redhat.com/errata/RHSA-2026:34741","https://access.redhat.com/errata/RHSA-2026:34740","https://access.redhat.com/errata/RHSA-2026:34739","https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37283"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wf93-45jw-7689","description":"pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory"},"relatedVulnerabilities":[{"id":"CVE-2026-8643","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8643","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8643","date":"2026-10-09","epss":0.00466,"percentile":0.38381}],"urls":["https://github.com/pypa/pip/pull/14000","https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/","http://www.openwall.com/lists/oss-security/2026/06/01/5","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:34739","https://access.redhat.com/errata/RHSA-2026:34740","https://access.redhat.com/errata/RHSA-2026:34741","https://access.redhat.com/errata/RHSA-2026:34748","https://access.redhat.com/errata/RHSA-2026:34749","https://access.redhat.com/errata/RHSA-2026:34750","https://access.redhat.com/errata/RHSA-2026:34752","https://access.redhat.com/errata/RHSA-2026:34756","https://access.redhat.com/errata/RHSA-2026:34758","https://access.redhat.com/errata/RHSA-2026:34760","https://access.redhat.com/errata/RHSA-2026:34765","https://access.redhat.com/errata/RHSA-2026:34772","https://access.redhat.com/errata/RHSA-2026:34773","https://access.redhat.com/errata/RHSA-2026:34774","https://access.redhat.com/errata/RHSA-2026:34775","https://access.redhat.com/errata/RHSA-2026:34776","https://access.redhat.com/errata/RHSA-2026:34777","https://access.redhat.com/errata/RHSA-2026:34778","https://access.redhat.com/errata/RHSA-2026:34780","https://access.redhat.com/errata/RHSA-2026:34891","https://access.redhat.com/errata/RHSA-2026:36193","https://access.redhat.com/errata/RHSA-2026:36315","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37283","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42144","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56347","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-8643","https://bugzilla.redhat.com/show_bug.cgi?id=2460927","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8643","description":"pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory."}]},{"artifact":{"id":"69f2cf32e9bda724","cpes":["cpe:2.3:a:libde265-0:libde265-0:1.0.15-1\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libde265-0:libde265_0:1.0.15-1\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libde265_0:libde265-0:1.0.15-1\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libde265_0:libde265_0:1.0.15-1\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265-0:1.0.15-1\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265_0:1.0.15-1\\+deb13u2:*:*:*:*:*:*:*"],"name":"libde265-0","purl":"pkg:deb/debian/libde265-0@1.0.15-1%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=libde265","type":"deb","version":"1.0.15-1+deb13u2","language":"","licenses":["BSD-4-clause","GPL-3","GPL-3+","LGPL-3","LGPL-3+","other-1","public-domain-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libde265-0/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libde265-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libde265-0:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libde265-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libde265"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88373","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libde265","version":"1.0.15-1+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88373","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88373","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88373","date":"2026-10-09","epss":0.00343,"percentile":0.25821}],"risk":0.25725000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88373","description":"libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-88373","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88373","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88373","date":"2026-10-09","epss":0.00343,"percentile":0.25821}],"urls":["https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","https://github.com/strukturag/libde265/issues/534"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88373","description":"libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service."}]},{"artifact":{"id":"0dac94e9330a575b","cpes":["cpe:2.3:a:nltk:nltk:3.10.3:*:*:*:*:*:*:*"],"name":"nltk","purl":"pkg:pypi/nltk@3.10.3","type":"python","version":"3.10.3","language":"python","licenses":["Apache License, Version 2.0"],"locations":[{"path":"/opt/venv/lib/python3.12/site-packages/nltk-3.10.3.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/nltk-3.10.3.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/opt/venv/lib/python3.12/site-packages/nltk-3.10.3.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/nltk-3.10.3.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/opt/venv/lib/python3.12/site-packages/nltk-3.10.3.dist-info/top_level.txt","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/nltk-3.10.3.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8mgp-746c-j5xp","versionConstraint":"<=3.10.3 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"nltk","version":"3.10.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8mgp-746c-j5xp","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81726","cwe":"CWE-73","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-81726","date":"2026-10-09","epss":0.00339,"percentile":0.2535}],"risk":0.2567925,"urls":["https://github.com/nltk/nltk/security/advisories/GHSA-8mgp-746c-j5xp","https://nvd.nist.gov/vuln/detail/CVE-2026-81726","https://github.com/nltk/nltk/pull/3757","https://github.com/nltk/nltk/pull/3759","https://github.com/nltk/nltk/pull/3813","https://github.com/nltk/nltk/commit/2a92b71827d754ae8920261e7ed0c4bb283ab2d7","https://github.com/nltk/nltk/commit/a44a7af69bca87e92d9c4a701fcbbe4512e8d450","https://github.com/nltk/nltk/commit/cbc98458b43de5f792f0382583c16df39e5c5117","https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3740.yaml","https://www.vulncheck.com/advisories/nltk-through-3.10.3-path-traversal-via-model-artifact-apis"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8mgp-746c-j5xp","description":"NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots"},"relatedVulnerabilities":[{"id":"CVE-2026-81726","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81726","cwe":"CWE-73","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-81726","date":"2026-10-09","epss":0.00339,"percentile":0.2535}],"urls":["https://github.com/nltk/nltk/security/advisories/GHSA-8mgp-746c-j5xp","https://www.vulncheck.com/advisories/nltk-through-3.10.3-path-traversal-via-model-artifact-apis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81726","description":"NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"risk":0.25645,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"risk":0.25645,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"risk":0.25645,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"risk":0.25645,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-09","epss":0.00446,"percentile":0.36836}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"b07d834d26c4749b","cpes":["cpe:2.3:a:pip_developers_\\<distutils_sig_project:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:25.0.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@25.0.1","type":"python","version":"25.0.1","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4xh5-x5gv-qwph","versionConstraint":"<=25.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"25.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-4xh5-x5gv-qwph","fix":{"state":"fixed","versions":["25.3"],"available":[{"date":"2025-10-28","kind":"first-observed","version":"25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8869","date":"2026-10-09","epss":0.00469,"percentile":0.38682}],"risk":0.255605,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-8869","https://github.com/pypa/pip/pull/13550","https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN","https://github.com/pypa/pip/commit/f2b92314da012b9fffa36b3f3e67748a37ef464a","https://pip.pypa.io/en/stable/news/#v25-2","https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4xh5-x5gv-qwph","description":"pip's fallback tar extraction doesn't check symbolic links point to extraction directory"},"relatedVulnerabilities":[{"id":"CVE-2025-8869","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8869","date":"2026-10-09","epss":0.00469,"percentile":0.38682}],"urls":["https://github.com/pypa/pip/pull/13550","https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN/","https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8869","description":"When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.\nNote that upgrading pip to a \"fixed\" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.\n\nNote that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706\nand therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706\nthen pip doesn't use the \"vulnerable\" fallback code.\n\nMitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),\napplying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice."}]},{"artifact":{"id":"df23c4764411e8ea","cpes":["cpe:2.3:a:pip_developers_\\<distutils_sig_project:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig_project:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sigproject:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip-developers-\\<distutils-sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_\\<distutils_sig:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:25.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:25.0.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@25.0.1","type":"python","version":"25.0.1","language":"python","licenses":["MIT"],"locations":[{"path":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pip-25.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4xh5-x5gv-qwph","versionConstraint":"<=25.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"25.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-4xh5-x5gv-qwph","fix":{"state":"fixed","versions":["25.3"],"available":[{"date":"2025-10-28","kind":"first-observed","version":"25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8869","date":"2026-10-09","epss":0.00469,"percentile":0.38682}],"risk":0.255605,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-8869","https://github.com/pypa/pip/pull/13550","https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN","https://github.com/pypa/pip/commit/f2b92314da012b9fffa36b3f3e67748a37ef464a","https://pip.pypa.io/en/stable/news/#v25-2","https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4xh5-x5gv-qwph","description":"pip's fallback tar extraction doesn't check symbolic links point to extraction directory"},"relatedVulnerabilities":[{"id":"CVE-2025-8869","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8869","date":"2026-10-09","epss":0.00469,"percentile":0.38682}],"urls":["https://github.com/pypa/pip/pull/13550","https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN/","https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8869","description":"When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.\nNote that upgrading pip to a \"fixed\" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.\n\nNote that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706\nand therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706\nthen pip doesn't use the \"vulnerable\" fallback code.\n\nMitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),\napplying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-09","epss":0.00444,"percentile":0.36597}],"risk":0.2553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-09","epss":0.00444,"percentile":0.36597}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-09","epss":0.00444,"percentile":0.36597}],"risk":0.2553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-09","epss":0.00444,"percentile":0.36597}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"risk":0.25242499999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"risk":0.25242499999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"risk":0.25242499999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"risk":0.25242499999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-09","epss":0.00439,"percentile":0.36234}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"99df015a43949852","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34980","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34980","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34980","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34980","date":"2026-10-09","epss":0.00335,"percentile":0.24918}],"risk":0.25125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34980","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34980","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34980","date":"2026-10-09","epss":0.00335,"percentile":0.24918}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34980","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"1159f482b12b5f01","cpes":["cpe:2.3:a:ghostscript:ghostscript:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"ghostscript","purl":"pkg:deb/debian/ghostscript@10.05.1~dfsg-1%2Bdeb13u1?arch=amd64&distro=debian-13.7","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ghostscript/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/ghostscript/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ghostscript.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ghostscript.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.list"},{"path":"/var/lib/dpkg/info/ghostscript.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.postinst"},{"path":"/var/lib/dpkg/info/ghostscript.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/ghostscript.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-103226","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"risk":0.2486,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""},"relatedVulnerabilities":[{"id":"CVE-2026-103226","cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"urls":["https://artifex.com/","https://bugs.ghostscript.com/attachment.cgi?id=28495","https://bugs.ghostscript.com/show_bug.cgi?id=709672","https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3","https://vuldb.com/cve/CVE-2026-103226","https://vuldb.com/submit/955016","https://vuldb.com/vuln/411906","https://vuldb.com/vuln/411906/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}]},{"artifact":{"id":"5817a708ca9571e4","cpes":["cpe:2.3:a:libgs-common:libgs-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs-common:libgs_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs_common:libgs-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs_common:libgs_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs:libgs-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs:libgs_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgs-common","purl":"pkg:deb/debian/libgs-common@10.05.1~dfsg-1%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=ghostscript","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgs-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs-common.list"}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-103226","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"risk":0.2486,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""},"relatedVulnerabilities":[{"id":"CVE-2026-103226","cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"urls":["https://artifex.com/","https://bugs.ghostscript.com/attachment.cgi?id=28495","https://bugs.ghostscript.com/show_bug.cgi?id=709672","https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3","https://vuldb.com/cve/CVE-2026-103226","https://vuldb.com/submit/955016","https://vuldb.com/vuln/411906","https://vuldb.com/vuln/411906/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}]},{"artifact":{"id":"fb50d606edd69206","cpes":["cpe:2.3:a:libgs10:libgs10:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgs10","purl":"pkg:deb/debian/libgs10@10.05.1~dfsg-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ghostscript","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgs10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-103226","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"risk":0.2486,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""},"relatedVulnerabilities":[{"id":"CVE-2026-103226","cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"urls":["https://artifex.com/","https://bugs.ghostscript.com/attachment.cgi?id=28495","https://bugs.ghostscript.com/show_bug.cgi?id=709672","https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3","https://vuldb.com/cve/CVE-2026-103226","https://vuldb.com/submit/955016","https://vuldb.com/vuln/411906","https://vuldb.com/vuln/411906/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}]},{"artifact":{"id":"2e51e497614527b2","cpes":["cpe:2.3:a:libgs10-common:libgs10-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10-common:libgs10_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10_common:libgs10-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10_common:libgs10_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10:libgs10-common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgs10:libgs10_common:10.05.1\\~dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgs10-common","purl":"pkg:deb/debian/libgs10-common@10.05.1~dfsg-1%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=ghostscript","type":"deb","version":"10.05.1~dfsg-1+deb13u1","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs10-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgs10-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs10-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgs10-common.list"}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ghostscript","version":"10.05.1~dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-103226","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"risk":0.2486,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""},"relatedVulnerabilities":[{"id":"CVE-2026-103226","cvss":[{"type":"Primary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103226","cwe":"CWE-119","type":"Primary","source":"cna@vuldb.com"},{"cve":"CVE-2026-103226","cwe":"CWE-121","type":"Primary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-103226","date":"2026-10-09","epss":0.0044,"percentile":0.36279}],"urls":["https://artifex.com/","https://bugs.ghostscript.com/attachment.cgi?id=28495","https://bugs.ghostscript.com/show_bug.cgi?id=709672","https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3","https://vuldb.com/cve/CVE-2026-103226","https://vuldb.com/submit/955016","https://vuldb.com/vuln/411906","https://vuldb.com/vuln/411906/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}]},{"artifact":{"id":"99df015a43949852","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34978","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34978","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-09","epss":0.0042,"percentile":0.34305}],"risk":0.24149999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34978","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34978","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-09","epss":0.0042,"percentile":0.34305}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34978","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8286","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-09","epss":0.00309,"percentile":0.21847}],"risk":0.24101999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not."},"relatedVulnerabilities":[{"id":"CVE-2026-8286","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-09","epss":0.00309,"percentile":0.21847}],"urls":["https://curl.se/docs/CVE-2026-8286.html","https://curl.se/docs/CVE-2026-8286.json","https://hackerone.com/reports/3718195"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8286","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-09","epss":0.00309,"percentile":0.21847}],"risk":0.24101999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not."},"relatedVulnerabilities":[{"id":"CVE-2026-8286","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-09","epss":0.00309,"percentile":0.21847}],"urls":["https://curl.se/docs/CVE-2026-8286.html","https://curl.se/docs/CVE-2026-8286.json","https://hackerone.com/reports/3718195"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8286","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-09","epss":0.00309,"percentile":0.21847}],"risk":0.24101999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not."},"relatedVulnerabilities":[{"id":"CVE-2026-8286","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-09","epss":0.00309,"percentile":0.21847}],"urls":["https://curl.se/docs/CVE-2026-8286.html","https://curl.se/docs/CVE-2026-8286.json","https://hackerone.com/reports/3718195"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86420","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"risk":0.24075,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-denial-of-service-memory-budget"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86420","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"risk":0.24075,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-denial-of-service-memory-budget"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86420","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"risk":0.24075,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-denial-of-service-memory-budget"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86420","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"risk":0.24075,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-denial-of-service-memory-budget"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86420","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"risk":0.24075,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-86420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86420","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86420","date":"2026-10-09","epss":0.00321,"percentile":0.23134}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-denial-of-service-memory-budget"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86420","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"risk":0.23725000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"risk":0.23725000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"risk":0.23725000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"risk":0.23725000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-09","epss":0.00325,"percentile":0.23644}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"risk":0.2336,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"risk":0.2336,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"risk":0.2336,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"risk":0.2336,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-09","epss":0.00292,"percentile":0.19957}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"50f3e6307c72b0b7","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68471","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"risk":0.23287499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."},"relatedVulnerabilities":[{"id":"CVE-2025-68471","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"urls":["https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1","https://github.com/avahi/avahi/issues/678","https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."}]},{"artifact":{"id":"e0cedc6dccd6380c","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68471","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"risk":0.23287499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."},"relatedVulnerabilities":[{"id":"CVE-2025-68471","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"urls":["https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1","https://github.com/avahi/avahi/issues/678","https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."}]},{"artifact":{"id":"f8b8769b671bcd56","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68471","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"risk":0.23287499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."},"relatedVulnerabilities":[{"id":"CVE-2025-68471","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-09","epss":0.00405,"percentile":0.32727}],"urls":["https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1","https://github.com/avahi/avahi/issues/678","https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"risk":0.22999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"risk":0.22999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.13.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15366","versionConstraint":"< 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.13.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15366","versionConstraint":"< 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"fixed","versions":["3.13.15","3.14.7","3.15.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.13.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.7"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a6"},{"date":"2026-08-12","kind":"first-observed","version":"3.13.15"},{"date":"2026-08-12","kind":"first-observed","version":"3.14.7"},{"date":"2026-03-03","kind":"first-observed","version":"3.15.0a6"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"risk":0.22999,"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"risk":0.22999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"risk":0.22999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-09","epss":0.00422,"percentile":0.34519}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-09","epss":0.00297,"percentile":0.20545}],"risk":0.22572,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-09","epss":0.00297,"percentile":0.20545}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-09","epss":0.00297,"percentile":0.20545}],"risk":0.22572,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-09","epss":0.00297,"percentile":0.20545}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-09","epss":0.00412,"percentile":0.33461}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"a22d24d52d83d4d8","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.18-3.1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=cjson","type":"deb","version":"1.7.18-3.1+deb13u1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16554","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cjson","version":"1.7.18-3.1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-16554","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-10-09","epss":0.00291,"percentile":0.19935}],"risk":0.222615,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-16554","description":"cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.     Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."},"relatedVulnerabilities":[{"id":"CVE-2026-16554","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-10-09","epss":0.00291,"percentile":0.19935}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-16554","https://github.com/DaveGamble/cJSON","http://www.openwall.com/lists/oss-security/2026/07/30/26","http://www.openwall.com/lists/oss-security/2026/07/31/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16554","description":"cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."}]},{"artifact":{"id":"4f58c885e32d1fec","cpes":["cpe:2.3:a:libpoppler147:libpoppler147:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"libpoppler147","purl":"pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler147/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpoppler147/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2820","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-2820","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-2820","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2820","date":"2026-10-09","epss":0.04415,"percentile":0.91108}],"risk":0.22075000000000003,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2820","description":"An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library."},"relatedVulnerabilities":[{"id":"CVE-2017-2820","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-2820","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2820","date":"2026-10-09","epss":0.04415,"percentile":0.91108}],"urls":["http://www.securityfocus.com/bid/99497","https://talosintelligence.com/vulnerability_reports/TALOS-2017-0321"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2820","description":"An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library."}]},{"artifact":{"id":"4a1904c022e79f58","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/debian/poppler-utils@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2820","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-2820","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-2820","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2820","date":"2026-10-09","epss":0.04415,"percentile":0.91108}],"risk":0.22075000000000003,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2820","description":"An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library."},"relatedVulnerabilities":[{"id":"CVE-2017-2820","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-2820","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2820","date":"2026-10-09","epss":0.04415,"percentile":0.91108}],"urls":["http://www.securityfocus.com/bid/99497","https://talosintelligence.com/vulnerability_reports/TALOS-2017-0321"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2820","description":"An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-09","epss":0.00402,"percentile":0.32368}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"risk":0.21909000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-09","epss":0.00402,"percentile":0.32367}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"50f3e6307c72b0b7","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68468","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."},"relatedVulnerabilities":[{"id":"CVE-2025-68468","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"urls":["https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a","https://github.com/avahi/avahi/issues/683","https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."}]},{"artifact":{"id":"e0cedc6dccd6380c","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68468","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."},"relatedVulnerabilities":[{"id":"CVE-2025-68468","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"urls":["https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a","https://github.com/avahi/avahi/issues/683","https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."}]},{"artifact":{"id":"f8b8769b671bcd56","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68468","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."},"relatedVulnerabilities":[{"id":"CVE-2025-68468","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-09","epss":0.0038,"percentile":0.29942}],"urls":["https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a","https://github.com/avahi/avahi/issues/683","https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."}]},{"artifact":{"id":"147b3d90c1d1a5d5","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76956","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76956","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76956","cwe":"CWE-394","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76956","date":"2026-10-09","epss":0.00287,"percentile":0.19539}],"risk":0.21525,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76956","description":"In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content."},"relatedVulnerabilities":[{"id":"CVE-2026-76956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76956","cwe":"CWE-394","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76956","date":"2026-10-09","epss":0.00287,"percentile":0.19539}],"urls":["https://github.com/libexpat/libexpat/pull/1326","https://github.com/libexpat/libexpat/pull/1329"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76956","description":"In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content."}]},{"artifact":{"id":"5639ec83ccf64c26","cpes":["cpe:2.3:a:curl:curl:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8458","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-09","epss":0.00371,"percentile":0.29048}],"risk":0.213325,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services."},"relatedVulnerabilities":[{"id":"CVE-2026-8458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-09","epss":0.00371,"percentile":0.29048}],"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."}]},{"artifact":{"id":"9e5beaf1197f535a","cpes":["cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64-gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64_gnutls:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64-gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3t64:libcurl3t64_gnutls:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl3t64-gnutls","purl":"pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3t64-gnutls/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl3t64-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl3t64-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8458","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-09","epss":0.00371,"percentile":0.29048}],"risk":0.213325,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services."},"relatedVulnerabilities":[{"id":"CVE-2026-8458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-09","epss":0.00371,"percentile":0.29048}],"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."}]},{"artifact":{"id":"2b5843b2b58d0a1b","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.14.1-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=curl","type":"deb","version":"8.14.1-2+deb13u5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","BSD-4-Clause-UC","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"curl","version":"8.14.1-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8458","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-09","epss":0.00371,"percentile":0.29048}],"risk":0.213325,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services."},"relatedVulnerabilities":[{"id":"CVE-2026-8458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-09","epss":0.00371,"percentile":0.29048}],"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."}]},{"artifact":{"id":"f95bb02a97e4846d","cpes":["cpe:2.3:a:libxrender1:libxrender1:1\\:0.9.12-1:*:*:*:*:*:*:*"],"name":"libxrender1","purl":"pkg:deb/debian/libxrender1@1%3A0.9.12-1?arch=amd64&distro=debian-13.7&upstream=libxrender","type":"deb","version":"1:0.9.12-1","language":"","licenses":["HPND-sell-variant"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxrender1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libxrender1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxrender"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88807","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxrender","version":"1:0.9.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88807","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-09","epss":0.0026,"percentile":0.16273}],"risk":0.21320000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."},"relatedVulnerabilities":[{"id":"CVE-2026-88807","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-09","epss":0.0026,"percentile":0.16273}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."}]},{"artifact":{"id":"809ea4b423ef5f0e","cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.9-3\\+deb13u4:*:*:*:*:*:*:*"],"name":"libgnutls30t64","purl":"pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=gnutls28","type":"deb","version":"3.8.9-3+deb13u4","language":"","licenses":["sha256:a07e99815cf1998f1dabbc21fe199460bfa09b85ead0d56b49a32cac3d1791b5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnutls28","version":"3.8.9-3+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95209","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95209","date":"2026-10-09","epss":0.00284,"percentile":0.19248}],"risk":0.213,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95209","description":"An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-95209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95209","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95209","date":"2026-10-09","epss":0.00284,"percentile":0.19248}],"urls":["http://gnutls.com","https://evil.com","https://gist.github.com/lkloliver/8e4498311aff18e2077010e412043e18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95209","description":"An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"99df015a43949852","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34979","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34979","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-09","epss":0.00413,"percentile":0.33578}],"risk":0.212695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34979","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34979","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-09","epss":0.00413,"percentile":0.33578}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34979","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"99df015a43949852","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-41079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-09","epss":0.00409,"percentile":0.33069}],"risk":0.21267999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17."},"relatedVulnerabilities":[{"id":"CVE-2026-41079","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-09","epss":0.00409,"percentile":0.33069}],"urls":["https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080","https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737","https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17."}]},{"artifact":{"id":"213d133cc46bf69b","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3.1:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64&distro=debian-13.7","type":"deb","version":"1.35+dfsg-3.1","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/tar.prerm"},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/tar.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tar","version":"1.35+dfsg-3.1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-09","epss":0.00401,"percentile":0.3229}],"risk":0.210525,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[{"id":"CVE-2026-5704","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-09","epss":0.00401,"percentile":0.3229}],"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."}]},{"artifact":{"id":"f147235c8d804877","cpes":["cpe:2.3:a:libjxl0.11:libjxl0.11:0.11.2-0.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libjxl0.11","purl":"pkg:deb/debian/libjxl0.11@0.11.2-0.1~deb13u2?arch=amd64&distro=debian-13.7&upstream=jpeg-xl","type":"deb","version":"0.11.2-0.1~deb13u2","language":"","licenses":["BSD-3-clause-Google","ISC-License"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjxl0.11/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libjxl0.11/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjxl0.11:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libjxl0.11:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"jpeg-xl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"jpeg-xl","version":"0.11.2-0.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82522","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-10-09","epss":0.00407,"percentile":0.32947}],"risk":0.20960499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82522","description":"libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads."},"relatedVulnerabilities":[{"id":"CVE-2026-82522","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-10-09","epss":0.00407,"percentile":0.32947}],"urls":["https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68","https://github.com/libjxl/libjxl/pull/4885","https://github.com/libjxl/libjxl/releases/tag/v0.12.0","https://www.vulncheck.com/advisories/libjxl-container-box-parser-integer-underflow-via-32-bit-size-truncation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82522","description":"libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads."}]},{"artifact":{"id":"809ea4b423ef5f0e","cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.9-3\\+deb13u4:*:*:*:*:*:*:*"],"name":"libgnutls30t64","purl":"pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=gnutls28","type":"deb","version":"3.8.9-3+deb13u4","language":"","licenses":["sha256:a07e99815cf1998f1dabbc21fe199460bfa09b85ead0d56b49a32cac3d1791b5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnutls28","version":"3.8.9-3+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95210","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95210","date":"2026-10-09","epss":0.00228,"percentile":0.1244}],"risk":0.20634,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95210","description":"Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions."},"relatedVulnerabilities":[{"id":"CVE-2026-95210","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95210","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95210","date":"2026-10-09","epss":0.00228,"percentile":0.1244}],"urls":["http://gnutls.com","https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7","https://github.com/lkloliver/poc/tree/main/CVE-2026-95210"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95210","description":"Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions."}]},{"artifact":{"id":"89e4a79e83ba4a33","cpes":["cpe:2.3:a:libpython3.13-minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_minimal:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-minimal","purl":"pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"risk":0.20110500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"930c5e644d3d53cf","cpes":["cpe:2.3:a:libpython3.13-stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13-stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13_stdlib:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13-stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.13:libpython3.13_stdlib:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"libpython3.13-stdlib","purl":"pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpython3.13-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpython3.13-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"risk":0.20110500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"a0a5380ad94980da","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.14","type":"binary","version":"3.12.14","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.14:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.14"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"fixed","versions":["3.15.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a6"},{"date":"2026-03-03","kind":"first-observed","version":"3.15.0a6"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"risk":0.20110500000000003,"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"203cc3eac245dbd0","cpes":["cpe:2.3:a:python3.13:python3.13:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13","purl":"pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.list"},{"path":"/var/lib/dpkg/info/python3.13.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.postinst"},{"path":"/var/lib/dpkg/info/python3.13.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"risk":0.20110500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"77bc21d87dc8c5dd","cpes":["cpe:2.3:a:python3.13-minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13-minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13_minimal:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13-minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:python3.13:python3.13_minimal:3.13.5-2\\+deb13u5:*:*:*:*:*:*:*"],"name":"python3.13-minimal","purl":"pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u5?arch=amd64&distro=debian-13.7&upstream=python3.13","type":"deb","version":"3.13.5-2+deb13u5","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.13-minimal/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/python3.13-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.13-minimal.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.list"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.13-minimal.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.13-minimal.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/python3.13-minimal.prerm"}],"upstreams":[{"name":"python3.13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"python3.13","version":"3.13.5-2+deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"risk":0.20110500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-09","epss":0.00369,"percentile":0.28696}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"213d133cc46bf69b","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3.1:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64&distro=debian-13.7","type":"deb","version":"1.35+dfsg-3.1","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/tar.prerm"},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/tar.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2005-2541","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tar","version":"1.35+dfsg-3.1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2005-2541","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-09","epss":0.03992,"percentile":0.90261}],"risk":0.1996,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."},"relatedVulnerabilities":[{"id":"CVE-2005-2541","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-09","epss":0.03992,"percentile":0.90261}],"urls":["http://marc.info/?l=bugtraq&m=112327628230258&w=2","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."}]},{"artifact":{"id":"3f14f57e5d4140a1","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-72897","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"risk":0.1995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected.  Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service.  CWE: CWE-787: Out-of-bounds Write  Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags.  An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process.  Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3.  The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity.  FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-72897","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8ad59b627628fd53","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-72897","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"risk":0.1995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected.  Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service.  CWE: CWE-787: Out-of-bounds Write  Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags.  An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process.  Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3.  The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity.  FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-72897","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4b8c5bd5be8079b2","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-72897","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"risk":0.1995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected.  Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service.  CWE: CWE-787: Out-of-bounds Write  Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags.  An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process.  Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3.  The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity.  FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-72897","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-09","epss":0.00266,"percentile":0.16966}],"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"3f14f57e5d4140a1","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"risk":0.199305,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead.  Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact.  CWE: CWE-1284: Improper Validation of Specified Quantity in Input  Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication.  In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS.  The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record.  FIPS impact: no The affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"8ad59b627628fd53","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"risk":0.199305,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead.  Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact.  CWE: CWE-1284: Improper Validation of Specified Quantity in Input  Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication.  In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS.  The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record.  FIPS impact: no The affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"4b8c5bd5be8079b2","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"risk":0.199305,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead.  Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact.  CWE: CWE-1284: Improper Validation of Specified Quantity in Input  Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication.  In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS.  The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record.  FIPS impact: no The affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-09","epss":0.00387,"percentile":0.30686}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-09","epss":0.00384,"percentile":0.30388}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"risk":0.19776,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-09","epss":0.00384,"percentile":0.30387}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"risk":0.19183499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"risk":0.19183499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"risk":0.19183499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"risk":0.19183499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-09","epss":0.00261,"percentile":0.16483}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-09","epss":0.00372,"percentile":0.29062}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"risk":0.19158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-09","epss":0.00372,"percentile":0.29061}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"147b3d90c1d1a5d5","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-09","epss":0.00348,"percentile":0.26383}],"risk":0.18966000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-09","epss":0.00348,"percentile":0.26383}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"4f58c885e32d1fec","cpes":["cpe:2.3:a:libpoppler147:libpoppler147:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"libpoppler147","purl":"pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler147/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpoppler147/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpoppler147:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107705","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107705","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107705","cwe":"CWE-121","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107705","date":"2026-10-09","epss":0.00328,"percentile":0.23874}],"risk":0.1886,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107705","description":"Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory."},"relatedVulnerabilities":[{"id":"CVE-2026-107705","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107705","cwe":"CWE-121","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107705","date":"2026-10-09","epss":0.00328,"percentile":0.23874}],"urls":["https://gitlab.freedesktop.org/poppler/poppler","https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767","https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814","https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107705","description":"Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory."}]},{"artifact":{"id":"4a1904c022e79f58","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:25.03.0-5\\+deb13u4:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/debian/poppler-utils@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=poppler","type":"deb","version":"25.03.0-5+deb13u4","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107705","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"poppler","version":"25.03.0-5+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107705","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107705","cwe":"CWE-121","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107705","date":"2026-10-09","epss":0.00328,"percentile":0.23874}],"risk":0.1886,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107705","description":"Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory."},"relatedVulnerabilities":[{"id":"CVE-2026-107705","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107705","cwe":"CWE-121","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107705","date":"2026-10-09","epss":0.00328,"percentile":0.23874}],"urls":["https://gitlab.freedesktop.org/poppler/poppler","https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767","https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814","https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107705","description":"Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory."}]},{"artifact":{"id":"99df015a43949852","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-8166","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2014-8166","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-8166","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-8166","date":"2026-10-09","epss":0.03703,"percentile":0.89461}],"risk":0.18515,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-8166","description":"The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name."},"relatedVulnerabilities":[{"id":"CVE-2014-8166","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-8166","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-8166","date":"2026-10-09","epss":0.03703,"percentile":0.89461}],"urls":["http://www.openwall.com/lists/oss-security/2015/03/24/15","http://www.openwall.com/lists/oss-security/2015/03/24/2","http://www.securityfocus.com/bid/73300","https://bugzilla.redhat.com/show_bug.cgi?id=1084577"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-8166","description":"The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name."}]},{"artifact":{"id":"6bd3c13550f2ca5e","cpes":["cpe:2.3:a:jose_padilla_\\<hello_project:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<hello_project:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<helloproject:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<helloproject:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<hello_project:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose-padilla-\\<hello:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose-padilla-\\<hello:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<hello:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<hello:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<helloproject:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose-padilla-\\<hello:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_\\<hello:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*"],"name":"pyjwt","purl":"pkg:pypi/pyjwt@2.14.0","type":"python","version":"2.14.0","language":"python","licenses":["MIT"],"locations":[{"path":"/opt/venv/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/opt/venv/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/opt/venv/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/top_level.txt","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-42vr-xj54-vc7v","versionConstraint":">=2.0.0a1,<=2.14.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.14.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-42vr-xj54-vc7v","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101918","date":"2026-10-09","epss":0.00358,"percentile":0.27536}],"risk":0.18437,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-42vr-xj54-vc7v","description":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)"},"relatedVulnerabilities":[{"id":"CVE-2026-101918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101918","date":"2026-10-09","epss":0.00358,"percentile":0.27536}],"urls":["https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"risk":0.183225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[{"id":"CVE-2026-66037","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"risk":0.183225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[{"id":"CVE-2026-66037","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"risk":0.183225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[{"id":"CVE-2026-66037","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"risk":0.183225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[{"id":"CVE-2026-66037","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-09","epss":0.00349,"percentile":0.26485}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."}]},{"artifact":{"id":"99df015a43949852","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=amd64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87875","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-09","epss":0.00392,"percentile":0.31258}],"risk":0.18228,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."},"relatedVulnerabilities":[{"id":"CVE-2026-87875","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-09","epss":0.00392,"percentile":0.31258}],"urls":["https://access.redhat.com/errata/RHSA-2026:66600","https://access.redhat.com/security/cve/CVE-2026-87875","https://bugzilla.redhat.com/show_bug.cgi?id=2530994","https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."}]},{"artifact":{"id":"3f14f57e5d4140a1","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75804","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"risk":0.18128,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits.  Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size).  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data.  Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error.  The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met:   - the remote peer opens several streams   - each stream must stay within the stream-level flow control limit   - there must be no zero-offset byte sent on any of the streams     (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-75804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8ad59b627628fd53","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75804","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"risk":0.18128,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits.  Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size).  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data.  Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error.  The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met:   - the remote peer opens several streams   - each stream must stay within the stream-level flow control limit   - there must be no zero-offset byte sent on any of the streams     (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-75804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4b8c5bd5be8079b2","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75804","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"risk":0.18128,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits.  Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size).  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data.  Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error.  The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met:   - the remote peer opens several streams   - each stream must stay within the stream-level flow control limit   - there must be no zero-offset byte sent on any of the streams     (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-75804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-09","epss":0.00352,"percentile":0.26794}],"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8a928cc6733b8d4c","cpes":["cpe:2.3:a:gcc-14-base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14-base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*"],"name":"gcc-14-base","purl":"pkg:deb/debian/gcc-14-base@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/gcc-14-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-14-base:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/gcc-14-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"4aef59838e786012","cpes":["cpe:2.3:a:libatomic1:libatomic1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"2338ed612a82adf3","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"71d32d5417d636ce","cpes":["cpe:2.3:a:libgomp1:libgomp1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/debian/libgomp1@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"7dc961cf921ecd08","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:14.2.0-19:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=amd64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-09","epss":0.0025,"percentile":0.14954}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102635","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102635","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"risk":0.18023499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."},"relatedVulnerabilities":[{"id":"CVE-2026-102635","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196","https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc","https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102635","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102635","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"risk":0.18023499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."},"relatedVulnerabilities":[{"id":"CVE-2026-102635","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196","https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc","https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102635","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102635","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"risk":0.18023499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."},"relatedVulnerabilities":[{"id":"CVE-2026-102635","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196","https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc","https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102635","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102635","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"risk":0.18023499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."},"relatedVulnerabilities":[{"id":"CVE-2026-102635","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196","https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc","https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102635","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102635","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"risk":0.18023499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."},"relatedVulnerabilities":[{"id":"CVE-2026-102635","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102635","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102635","date":"2026-10-09","epss":0.00319,"percentile":0.22905}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196","https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc","https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102635","description":"ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information."}]},{"artifact":{"id":"21dce3319984aa9d","cpes":["cpe:2.3:a:libheif-plugin-dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_dav1d:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_dav1d:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-dav1d","purl":"pkg:deb/debian/libheif-plugin-dav1d@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-dav1d/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-dav1d/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-dav1d:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84451","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84451","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84451","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84451","date":"2026-10-09","epss":0.00311,"percentile":0.21968}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84451","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3."},"relatedVulnerabilities":[{"id":"CVE-2026-84451","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84451","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84451","date":"2026-10-09","epss":0.00311,"percentile":0.21968}],"urls":["https://github.com/strukturag/libheif/commit/8bfed9a9ed008e4ef28abc736284a90d3cba754f","https://github.com/strukturag/libheif/releases/tag/v1.23.3","https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84451","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3."}]},{"artifact":{"id":"3f651db8f6ca23b6","cpes":["cpe:2.3:a:libheif-plugin-libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_libde265:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_libde265:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif-plugin-libde265","purl":"pkg:deb/debian/libheif-plugin-libde265@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-libde265/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif-plugin-libde265/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif-plugin-libde265:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84451","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84451","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84451","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84451","date":"2026-10-09","epss":0.00311,"percentile":0.21968}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84451","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3."},"relatedVulnerabilities":[{"id":"CVE-2026-84451","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84451","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84451","date":"2026-10-09","epss":0.00311,"percentile":0.21968}],"urls":["https://github.com/strukturag/libheif/commit/8bfed9a9ed008e4ef28abc736284a90d3cba754f","https://github.com/strukturag/libheif/releases/tag/v1.23.3","https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84451","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3."}]},{"artifact":{"id":"1d906423bc44bd58","cpes":["cpe:2.3:a:libheif1:libheif1:1.19.8-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/debian/libheif1@1.19.8-1%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=libheif","type":"deb","version":"1.19.8-1+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-Clause-UC","BSL-1.0","Expat","GPL-3","GPL-3+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.23.4-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84451","versionConstraint":"< 1.23.4-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libheif","version":"1.19.8-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-84451","fix":{"state":"fixed","versions":["1.23.4-1~deb13u1"],"available":[{"date":"2026-09-28","kind":"advisory","version":"1.23.4-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84451","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84451","date":"2026-10-09","epss":0.00311,"percentile":0.21968}],"risk":0.17882499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6523-1","link":"https://security-tracker.debian.org/tracker/DSA-6523-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84451","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3."},"relatedVulnerabilities":[{"id":"CVE-2026-84451","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84451","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84451","date":"2026-10-09","epss":0.00311,"percentile":0.21968}],"urls":["https://github.com/strukturag/libheif/commit/8bfed9a9ed008e4ef28abc736284a90d3cba754f","https://github.com/strukturag/libheif/releases/tag/v1.23.3","https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84451","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3."}]},{"artifact":{"id":"0fa9072a5bfd36b6","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/debian/libsasl2-2@2.1.28%2Bdfsg1-9?arch=amd64&distro=debian-13.7&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-9","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-9"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-09","epss":0.00238,"percentile":0.13621}],"risk":0.17850000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-09","epss":0.00238,"percentile":0.13621}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"175bd219d71968b9","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.28\\+dfsg1-9:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/debian/libsasl2-modules-db@2.1.28%2Bdfsg1-9?arch=amd64&distro=debian-13.7&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-9","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-9"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-09","epss":0.00238,"percentile":0.13621}],"risk":0.17850000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-09","epss":0.00238,"percentile":0.13621}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"risk":0.17715999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"risk":0.17715999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"risk":0.17715999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"risk":0.17715999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"risk":0.17715999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-09","epss":0.00344,"percentile":0.25883}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-93590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93590","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"risk":0.17627999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."},"relatedVulnerabilities":[{"id":"CVE-2026-93590","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93590","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"risk":0.17627999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."},"relatedVulnerabilities":[{"id":"CVE-2026-93590","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93590","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"risk":0.17627999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."},"relatedVulnerabilities":[{"id":"CVE-2026-93590","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93590","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"risk":0.17627999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."},"relatedVulnerabilities":[{"id":"CVE-2026-93590","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93590","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"risk":0.17627999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."},"relatedVulnerabilities":[{"id":"CVE-2026-93590","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93590","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93590","date":"2026-10-09","epss":0.00312,"percentile":0.2214}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-uhdr-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93590","description":"ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"risk":0.17612999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"risk":0.17612999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-09","epss":0.00342,"percentile":0.25649}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"f5152615a12aeb3d","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"5c8cb5d5c2e5df78","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"bd4b70ba8c48d583","cpes":["cpe:2.3:a:liblastlog2-2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2-2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"liblastlog2-2","purl":"pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblastlog2-2/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/liblastlog2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblastlog2-2:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/liblastlog2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"cfe9c78846143096","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"a6e51e84db754048","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"faedc3139e685610","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"9db9d188fa9e89fc","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:4.16.0-2+really2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:f2ec4de84f559f5c7be4233b589cdbdbb5507807e05621b77320edd55a1f2a0f","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"bd55752b0f187487","cpes":["cpe:2.3:a:mount:mount:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"166978fa81223e72","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-09","epss":0.00216,"percentile":0.11011}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"risk":0.17167500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"risk":0.17167500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"risk":0.17167500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"risk":0.17167500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"risk":0.17167500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-09","epss":0.00315,"percentile":0.22498}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"50f3e6307c72b0b7","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24401","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"risk":0.17019999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."},"relatedVulnerabilities":[{"id":"CVE-2026-24401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"urls":["https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","https://github.com/avahi/avahi/issues/501","https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."}]},{"artifact":{"id":"e0cedc6dccd6380c","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24401","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"risk":0.17019999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."},"relatedVulnerabilities":[{"id":"CVE-2026-24401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"urls":["https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","https://github.com/avahi/avahi/issues/501","https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."}]},{"artifact":{"id":"f8b8769b671bcd56","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24401","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"risk":0.17019999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."},"relatedVulnerabilities":[{"id":"CVE-2026-24401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-09","epss":0.00296,"percentile":0.20496}],"urls":["https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","https://github.com/avahi/avahi/issues/501","https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."}]},{"artifact":{"id":"3f14f57e5d4140a1","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42772","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"risk":0.16995000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data.  Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth.  CWE: CWE-407: Inefficient Algorithmic Complexity  Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`.  By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-42772","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8ad59b627628fd53","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42772","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"risk":0.16995000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data.  Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth.  CWE: CWE-407: Inefficient Algorithmic Complexity  Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`.  By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-42772","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4b8c5bd5be8079b2","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.7-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=openssl","type":"deb","version":"3.5.7-1~deb13u2","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.7-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42772","versionConstraint":"< 3.5.7-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openssl","version":"3.5.7-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"fixed","versions":["3.5.7-1~deb13u3"],"available":[{"date":"2026-09-30","kind":"advisory","version":"3.5.7-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"risk":0.16995000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6531-1","link":"https://security-tracker.debian.org/tracker/DSA-6531-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data.  Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth.  CWE: CWE-407: Inefficient Algorithmic Complexity  Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`.  By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-42772","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-09","epss":0.0033,"percentile":0.24071}],"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"809ea4b423ef5f0e","cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.9-3\\+deb13u4:*:*:*:*:*:*:*"],"name":"libgnutls30t64","purl":"pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=gnutls28","type":"deb","version":"3.8.9-3+deb13u4","language":"","licenses":["sha256:a07e99815cf1998f1dabbc21fe199460bfa09b85ead0d56b49a32cac3d1791b5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnutls28","version":"3.8.9-3+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95184","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95184","date":"2026-10-09","epss":0.00223,"percentile":0.11902}],"risk":0.16725,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95184","description":"Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-95184","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95184","date":"2026-10-09","epss":0.00223,"percentile":0.11902}],"urls":["http://gnutls.com","https://evil.com","https://gist.github.com/lkloliver/0c8b47fa75a0958fa88587665b82ae15"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95184","description":"Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"risk":0.16531500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"risk":0.16531500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"risk":0.16531500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"risk":0.16531500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"risk":0.16531500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-09","epss":0.00321,"percentile":0.23128}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-09","epss":0.03249,"percentile":0.87973}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-09","epss":0.03249,"percentile":0.87973}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-09","epss":0.03249,"percentile":0.87973}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-09","epss":0.03249,"percentile":0.87973}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70632","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"risk":0.16160000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[{"id":"CVE-2026-70632","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70632","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"risk":0.16160000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[{"id":"CVE-2026-70632","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70632","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"risk":0.16160000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[{"id":"CVE-2026-70632","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70632","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"risk":0.16160000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[{"id":"CVE-2026-70632","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-09","epss":0.00202,"percentile":0.09276}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."}]},{"artifact":{"id":"cb5be0a6f4d630dc","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u2?arch=amd64&distro=debian-13.7&upstream=pcre2","type":"deb","version":"10.46-1~deb13u2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1~deb13u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"< 10.46-1~deb13u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pcre2","version":"10.46-1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"fixed","versions":["10.46-1~deb13u3"],"available":[{"date":"2026-09-29","kind":"advisory","version":"10.46-1~deb13u3"}]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-09","epss":0.00214,"percentile":0.10829}],"risk":0.16157000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6530-1","link":"https://security-tracker.debian.org/tracker/DSA-6530-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-09","epss":0.00214,"percentile":0.10829}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"risk":0.161025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"risk":0.161025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"78a1ba69a517930d","cpes":["cpe:2.3:a:imagemagick-7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7.q16:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7.q16:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7.q16","purl":"pkg:deb/debian/imagemagick-7.q16@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7.q16/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-7.q16.prerm","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"risk":0.161025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"b442da9136764fed","cpes":["cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16-10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16_10:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_7.q16:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickcore-7.q16-10","purl":"pkg:deb/debian/libmagickcore-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickcore-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickcore-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"risk":0.161025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"88d485775f8770dc","cpes":["cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16-10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16_10:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_7.q16:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-7.q16-10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_7.q16_10:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"libmagickwand-7.q16-10","purl":"pkg:deb/debian/libmagickwand-7.q16-10@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-7.q16-10/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libmagickwand-7.q16-10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libmagickwand-7.q16-10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"risk":0.161025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-09","epss":0.00285,"percentile":0.19338}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"3f0fdecb2ff5aec9","cpes":["cpe:2.3:a:massimiliano_pippi_\\<mpippi_project:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippi_project:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippiproject:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippiproject:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippi_project:banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano-pippi-\\<mpippi:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano-pippi-\\<mpippi:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippi:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippi:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippiproject:banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano-pippi-\\<mpippi:banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:massimiliano_pippi_\\<mpippi:banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-banks:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-banks:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_banks:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_banks:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:banks:python-banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:banks:python_banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-banks:banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_banks:banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:banks:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:banks:banks:2.4.5:*:*:*:*:*:*:*"],"name":"banks","purl":"pkg:pypi/banks@2.4.5","type":"python","version":"2.4.5","language":"python","licenses":["MIT"],"locations":[{"path":"/opt/venv/lib/python3.12/site-packages/banks-2.4.5.dist-info/METADATA","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/banks-2.4.5.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/opt/venv/lib/python3.12/site-packages/banks-2.4.5.dist-info/RECORD","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/opt/venv/lib/python3.12/site-packages/banks-2.4.5.dist-info/RECORD","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hmq2-7hp6-7crh","versionConstraint":"<=2.4.5 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"banks","version":"2.4.5"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hmq2-7hp6-7crh","fix":{"state":"fixed","versions":["2.5.0"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"2.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107717","cwe":"CWE-20","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107717","date":"2026-10-09","epss":0.00279,"percentile":0.18691}],"risk":0.16042499999999998,"urls":["https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh","https://github.com/masci/banks/pull/78","https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb","https://github.com/masci/banks/releases/tag/v2.5.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hmq2-7hp6-7crh","description":"Banks: User-controlled prompt input can be parsed as privileged chat messages"},"relatedVulnerabilities":[{"id":"CVE-2026-107717","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107717","cwe":"CWE-20","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107717","date":"2026-10-09","epss":0.00279,"percentile":0.18691}],"urls":["https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb","https://github.com/masci/banks/pull/78","https://github.com/masci/banks/releases/tag/v2.5.0","https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107717","description":"Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0."}]},{"artifact":{"id":"86ca7491bc4976c9","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-09","epss":0.03193,"percentile":0.87743}],"risk":0.15965000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-09","epss":0.03193,"percentile":0.87743}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"2dc9b457970cbedd","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=amd64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-09","epss":0.03193,"percentile":0.87743}],"risk":0.15965000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-09","epss":0.03193,"percentile":0.87743}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75141","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75141","date":"2026-10-09","epss":0.00199,"percentile":0.0893}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75141","description":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75142","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75142","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75142","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."}]},{"artifact":{"id":"8a68d79401886b54","cpes":["cpe:2.3:a:libavcodec61:libavcodec61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavcodec61","purl":"pkg:deb/debian/libavcodec61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavcodec61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavcodec61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75144","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75144","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."},"relatedVulnerabilities":[{"id":"CVE-2026-75144","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75142","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75142","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75142","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."}]},{"artifact":{"id":"7007be08ccc15afe","cpes":["cpe:2.3:a:libavformat61:libavformat61:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavformat61","purl":"pkg:deb/debian/libavformat61@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat61/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavformat61/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavformat61:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75144","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75144","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."},"relatedVulnerabilities":[{"id":"CVE-2026-75144","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75142","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75142","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75142","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."}]},{"artifact":{"id":"be087e908708db17","cpes":["cpe:2.3:a:libavutil59:libavutil59:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libavutil59","purl":"pkg:deb/debian/libavutil59@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil59/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libavutil59/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libavutil59:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75144","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75144","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."},"relatedVulnerabilities":[{"id":"CVE-2026-75144","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75142","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75142","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."},"relatedVulnerabilities":[{"id":"CVE-2026-75142","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75142","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75142","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75142","description":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing."}]},{"artifact":{"id":"d2342752c0273263","cpes":["cpe:2.3:a:libswresample5:libswresample5:7\\:7.1.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libswresample5","purl":"pkg:deb/debian/libswresample5@7%3A7.1.5-0%2Bdeb13u1?arch=amd64&distro=debian-13.7&upstream=ffmpeg","type":"deb","version":"7:7.1.5-0+deb13u1","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample5/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/libswresample5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/libswresample5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75144","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ffmpeg","version":"7:7.1.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-75144","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"risk":0.1592,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."},"relatedVulnerabilities":[{"id":"CVE-2026-75144","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75144","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75144","date":"2026-10-09","epss":0.00199,"percentile":0.08929}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75144","description":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output."}]},{"artifact":{"id":"98b6c087ad98ffe1","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/debian/imagemagick@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=amd64&distro=debian-13.7","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107208","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107208","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107208","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107208","date":"2026-10-09","epss":0.00302,"percentile":0.21036}],"risk":0.15553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107208","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107208","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107208","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107208","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107208","date":"2026-10-09","epss":0.00302,"percentile":0.21036}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/907b74817836b4f88e7453f0e95c849a1c5311aa","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-27m9-54jx-fgvq","https://github.com/ImageMagick/ImageMagick6/commit/6ba345f88a14fcce35c723c231914ae054c4281a","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107208","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"313023f42280be25","cpes":["cpe:2.3:a:imagemagick-7-common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7-common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7_common:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_7:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-7-common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_7_common:8\\:7.1.1.43\\+dfsg1-1\\+deb13u12:*:*:*:*:*:*:*"],"name":"imagemagick-7-common","purl":"pkg:deb/debian/imagemagick-7-common@8%3A7.1.1.43%2Bdfsg1-1%2Bdeb13u12?arch=all&distro=debian-13.7&upstream=imagemagick","type":"deb","version":"8:7.1.1.43+dfsg1-1+deb13u12","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-7-common/copyright","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/usr/share/doc/imagemagick-7-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-7-common.list","layerID":"sha256:f4409d57b6a6960fbf098a28d1ffede4f7188d526ff8955a8d8098ab537184eb","accessPath":"/var/lib/dpkg/info/imagemagick-7-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"imagemagick","version":"8:7.1.1.43+dfsg1-1+deb13u12"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107208","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107208","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107208","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107208","date":"2026-10-09","epss":0.00302,"percentile":0.21036}],"risk":0.15553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107208","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."},"relatedVulnerabilities":[{"id":"CVE-2026-107208","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107208","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107208","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107208","date":"2026-10-09","epss":0.00302,"percentile":0.21036}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/907b74817836b4f88e7453f0e95c849a1c5311aa","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-27m9-54jx-fgvq","https://github.com/ImageMagick/ImageMagick6/commit/6ba345f88a14fcce35c723c231914ae054c4281a","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107208","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]}],"grade":"F","score":"0.00","as_of":"2026-10-10T15:06:30.473Z","grype_db_version":"2026-10-09T06:32:32.000Z"}