Loading story…
Two high-severity vulnerabilities were disclosed in widely used file-parsing libraries, allowing crafted media files to trigger memory-safety failures during parsing. In cgltf <= 1.15, CVE-2026-32845 stems from an integer overflow in cgltf_validate() while checking sparse accessors in malicious glTF or GLB files. The unchecked arithmetic can lead to heap buffer over-reads in cgltf_calc_index_bound(), causing crashes and potentially exposing process memory.
A separate flaw, CVE-2026-40494, affects the SAIL image loading and saving library’s TGA RLE decoder in tga.c. The bug is a heap-based buffer overflow caused by missing bounds checks on the raw-packet path, while the run-packet path correctly clamps writes; attackers can use a crafted TGA file to write up to 496 bytes of controlled data past the end of a heap buffer. The issue affects versions before commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 and carries a critical CVSS:3.1 rating due to potential confidentiality, integrity, and availability impact.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A heap-based buffer overflow in SAIL's TGA RLE decoder was received by GitHub Security Advisories, describing a missing bounds check in the raw-packet path that can allow controlled heap out-of-bounds writes. The disclosure noted that versions before commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 are affected and that the referenced commit patches the flaw.
A high-severity integer overflow vulnerability affecting cgltf 1.15 and earlier was documented, involving unchecked arithmetic in cgltf_validate() that can lead to heap buffer over-reads in cgltf_calc_index_bound() via crafted glTF or GLB files. The issue was referenced through a GitHub issue and a VulnCheck advisory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and security researchers disclosed **two high-severity libpng vulnerabilities** that can be triggered by processing crafted PNG files, exposing applications and services that rely on the library for image handling. **`CVE-2026-33416`** is a use-after-free bug tied to pointer aliasing in `png_set_tRNS` and `png_set_PLTE`, affecting libpng through version `1.6.55`; the flaw can cause heap corruption and may enable arbitrary code execution, particularly where protections such as ASLR or PIE are absent. Microsoft published guidance for `CVE-2026-33416` through its Security Update Guide. A second issue, **`CVE-2026-33636`**, affects **ARM and AArch64** platforms in Neon-optimized palette expansion code introduced in version `1.6.36`, creating an out-of-bounds read/write condition that can leak sensitive data, corrupt memory, and reliably crash processes. The vulnerabilities affect web applications, embedded devices, and server-side image processing pipelines that parse untrusted PNG content. Maintainers released patched versions **`1.6.56`** and **`1.8.0`**; as a temporary mitigation for the ARM-specific flaw, organizations can rebuild libpng with hardware optimizations disabled.
Jun 29, 2026
Two vulnerabilities affecting VLC Media Player versions `3.0.0` through `3.0.23` allow attacker-controlled media content to corrupt heap memory or expose client memory. High-severity `CVE-2026-56711`, discovered by Fabian Wahle of Hap Security, is an integer-overflow and out-of-bounds-write flaw in picture-buffer allocation that can be triggered with an oversized crafted PNG image; successful exploitation may lead to heap corruption and potentially code execution. Medium-severity `CVE-2026-73324` affects RTSP response parsing: a malicious RTSP server, including one reached through a crafted playlist, can provide an overlong `Session` header and retrieve adjacent heap memory. VideoLAN and distribution maintainers had not yet provided patched releases, so users should avoid untrusted PNG files, playlists, and RTSP streams; organizations should limit VLC use in high-risk workflows and block untrusted RTSP connections where practical.
Sep 14, 2026
Multiple **critical vulnerabilities** were disclosed in **GStreamer**, affecting several media parsers and demuxers including **ASF, RealMedia, DVB Subtitles, JPEG, RIFF, H.265, and H.266**. The issues include **heap/stack buffer overflows, out-of-bounds writes, and integer overflows/underflows** that can lead to **denial of service** or **remote code execution** when a user opens a crafted media file, with the most severe flaws identified as **CVE-2026-3083** and **CVE-2026-3085** in the `rtpqdm2depay` component. Belgian CCB warned that exploitation could expose sensitive data, compromise systems, and disrupt operations, and urged organizations to patch immediately. Debian separately issued **DSA-6167-1** for `gst-plugins-base1.0`, addressing **CVE-2026-2921**, an **integer overflow** in the **RIFF parser** that may cause a crash or potentially allow arbitrary code execution via a malformed media file. Debian released fixes for **bookworm** in version `1.22.0-3+deb12u6` and for **trixie** in version `1.26.2-1+deb13u1`. The GIMP advisory is unrelated to this event because it covers a separate **HDR file parsing** heap-based buffer overflow, **CVE-2026-2049**, in a different product.
Jun 29, 2026