Loading story…
A high-severity vulnerability tracked as CVE-2026-41907 was disclosed in the widely used uuid npm package, affecting versions prior to 14.0.0. The flaw stems from missing bounds checks in the v3, v5, and v6 functions when callers supply their own output buffer, allowing out-of-range writes when a buffer is too small or an offset is too large. The issue can cause silent partial writes into caller-provided buffers and is mapped to CWE-787 and CWE-823; the disclosure is also referenced in GitHub advisory GHSA-w5hq-g745-h8pq.
Maintainers fixed the issue in uuid 14.0.0, with backported patches released in 13.0.1, 12.0.1, and 11.1.1 for legacy deployments. Organizations that cannot upgrade immediately were advised to add explicit bounds validation before invoking the affected functions, ensuring offset + 16 does not exceed the destination buffer length, and to use static analysis tools such as Semgrep or ESLint to identify code paths where v3, v5, or v6 are called with caller-controlled Buffer or Uint8Array targets.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-41907 was published for the uuid npm package, describing an out-of-bounds write risk caused by insufficient validation of buffer size and offset in v3, v5, and v6. The advisory mapped the issue to CWE-787 and CWE-823 and referenced GitHub security advisory GHSA-w5hq-g745-h8pq.
The uuid project fixed a missing bounds check issue affecting v3, v5, and v6 when caller-provided buffers are used. The mainline fix was released in version 14.0.0, with backported fixes made available in versions 13.0.1, 12.0.1, and 11.1.1 for legacy branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-51235** has been disclosed in **LibRaw 0.21**, affecting the `stretch()` function in `src/libraw_cxx.cpp` and the `fuji_rotate()` function in `src/decoders/fuji.cpp`. The flaw is classified as **CWE-122** and described as a buffer overflow that could allow compromise of confidentiality, integrity, and availability. The CVSS v3.1 vector published for the issue is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating remote exploitation is possible with low attack complexity but requires user interaction. The CVE record was updated with **SSVC** metadata stating that proof-of-concept exploitation exists, automation is not currently indicated, and the technical impact is total. Public references tied to the disclosure include the LibRaw project and a GitHub advisory repository, where an update for **CVE-2026-51235** was also posted, signaling active tracking of the issue as defenders assess exposure in applications that process raw image files through the affected library.
Jul 28, 2026
CISA published an ICS advisory for **CVE-2026-3437**, a **high-severity** memory safety issue (*CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer*) affecting **Portwell Engineering Toolkits v4.8.2**. The flaw is in the Portwell Engineering Toolkits **driver** and could allow a **local, authenticated attacker** to **read and write arbitrary memory**, enabling **privilege escalation** or **denial of service**; CISA scored it **CVSS v3.1 8.8 (High)** with a local attack vector and low complexity. The CVE record corroborates the same impact and affected version, and additionally lists a **CVSS v4.0** vector consistent with high impact to confidentiality, integrity, and availability. The vulnerability was reported to CISA by **Jason Huang** of **TXOne Networks** (Cyber Threat & Product Defense Center), and the advisory notes deployment across critical infrastructure environments (including **Energy** and **Critical Manufacturing**) with worldwide exposure.
Jun 29, 2026