Others

OthersCVE-2025-53630 & CVE-2026-27940 > Heap-based buffer overflow via Integer overflow in llama.cpp GGUF parser

Không kiểm tra tràn số khi tính tổng kích thước cần cấp phát gây heap OOB read/write.

OthersCVE-2019-13288 > XPDF Infinite recursion & Null pointer dereference

CVE-2019-13288 breaks Xpdf’s invariant that the “object stream” referenced by a compressed object must be an uncompressed stream, because the fetch path doesn’t enforce that rule and a crafted xref can make the supposed object stream itself compressed, causing unbounded recursive fetching and a crash.

OthersCVE-2022-0324 > Buffer Overflow in dhcp6relay of SONiC

CVE-2022-0324 breaks the invariant that SONiC’s dhcp6relay must validate DHCPv6 option/payload lengths so it never copies more bytes than the destination buffer can hold.​The invariant is violated when a remote attacker sends a crafted DHCPv6 packet that reaches a memcpy with an unchecked length, causing an out-of-bounds write (buffer overflow).

OthersHeap Exploitation Technique - House of Orange