whisper.cpp: attacker-controlled tensor n_dims indexes a fixed ne[4] stack array while loading a model file (stack out-of-bounds write). Fixed in v1.9.3 prerelease and v1.9.4.
-
Updated
Oct 28, 2026 - Python
#
cwe-787
Here are 4 public repositories matching this topic...
Heap out-of-bounds write in onnx-tensorrt WeightsContext::convertPackedInt32Data via INT4/FP4 initializer (shape vs int32_data size). Fixed in release/11.0-GA.
-
Updated
Oct 28, 2026 - Python
libhv dns_name_decode: heap overflow to code execution (independent PoC + writeup). Bug originally reported in ithewei/libhv#851.
-
Updated
Oct 24, 2026 - C
PoC and containerized lab for CVE-2026-99273 — Linux ksmbd writes a UTF-16 terminator 2 bytes past a 448-byte response buffer in get_file_stream_info() (SMB2 QUERY_INFO FileStreamInformation): exact-fill stream entry and trailing ::$DATA path, guest-reachable. Validated end-to-end on Linux 7.3.0 ef85bad3 (vulnerable, KASAN) vs patched.
proof-of-concept smb linux-kernel poc security-research vulnerability-research heap-overflow ksmbd cwe-787 cve-2026-99273
-
Updated
Nov 8, 2026 - Python
Add this topic to your repo
To associate your repository with the cwe-787 topic, visit your repo's landing page and select "manage topics."