Loading story…
A buffer underwrite in fig2dev's get_line() function can be triggered by a crafted FIG file, causing out-of-bounds writes while the program strips trailing carriage returns from input. The flaw, tracked as CVE-2018-16140, affects fig2dev 3.2.7a and stems from unsafe access to buf[len-1] and buf[len-2] when the local length variable is too small, leading to segmentation faults and sanitizer-detected memory corruption.
The issue was previously reported in Debian against fig2dev 1:3.2.6a-6, where maintainers noted the bug in read.c and later marked it fixed in 1:3.2.7-1 through input sanitization changes. Subsequent research found the vulnerability was still reproducible in later code through fuzzing, indicating the earlier remediation was incomplete; a proper fix requires bounds checks before accessing trailing buffer positions, such as validating the length before touching buf[len-2].
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The buffer underwrite vulnerability in fig2dev 3.2.7a was publicly disclosed as CVE-2018-16140. The issue could be triggered with a crafted FIG file and was credited to the ACE Team at Loginsoft.
A patch release was issued for CVE-2018-16140 following vendor disclosure. The vulnerability affected fig2dev 3.2.7a's get_line() handling of short input lengths, which could trigger out-of-bounds access.
Loginsoft's ACE Team disclosed a buffer underwrite vulnerability later tracked as CVE-2018-16140 to the vendor. Their research found the issue remained reproducible in fig2dev 3.2.7a despite an earlier similar bug having been considered fixed.
Jakub Wilk reported a buffer underwrite vulnerability in fig2dev's get_line() function affecting version 1:3.2.6a-6. The bug involved out-of-bounds writes when the input length was 0 or, in some cases, 1.
Debian acknowledged bug #882022 as fixed in fig2dev version 1:3.2.7-1, noting that input sanitization in the new upstream 3.2.7 release addressed this and related issues. The closure message said the fix was included in the version headed to the Debian FTP archive.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's BPF disassembler was reported after **syzbot** and **UBSAN** identified an out-of-bounds array access in `print_bpf_insn()`, the function used to format BPF instructions for verifier diagnostics. The bug is triggered when a malformed signed-load instruction using `BPF_MEMSX | BPF_DW` reaches diagnostic disassembly code before opcode validation fully rejects it, causing the kernel to index past the end of the three-entry `bpf_ldsx_string[]` table. No evidence has been presented that the issue enables privilege escalation, information disclosure, remote exploitation, or abuse by unprivileged users. A two-patch fix was proposed and then applied to `bpf/bpf.git`, changing the disassembler to reject invalid signed double-word load encodings and fall back to the existing `BUG_ldx` diagnostic path instead of performing the unsafe table lookup. The patch series, authored by Kumar Kartikeya Dwivedi, reviewed by Jiayuan Chen, and merged by Daniel Borkmann, also adds a self-test to catch regressions. The issue appears to exist in current kernel source, but affected released versions and downstream distributions have not yet been identified.
Aug 21, 2026
Several critical stack-based buffer overflow vulnerabilities have been identified in the MFER parsing functionality of *The Biosig Project*'s `libbiosig` version 3.9.1. These vulnerabilities, tracked as CVE-2025-66044, CVE-2025-66045, CVE-2025-66046, CVE-2025-66047, and CVE-2025-66048, allow remote attackers to execute arbitrary code by supplying specially crafted MFER files. The vulnerabilities are present in the `sopen_extended` function, which is responsible for parsing various medical signal data formats, and can be triggered when specific MFER tags are processed. All vulnerabilities have been assigned a CVSS 3.1 base score of 9.8 (critical), and exploitation does not require authentication or user interaction. *libbiosig* is widely used in scientific and medical software, including Octave, Matlab, and sigviewer, for processing biomedical signal data such as EKG and EEG. The vulnerabilities were disclosed by Cisco Talos, which confirmed that version 3.9.1 is affected. Attackers exploiting these flaws could compromise systems that process untrusted MFER files, potentially impacting healthcare and research environments that rely on this library. Organizations using *libbiosig* are strongly advised to review the affected versions and apply any available patches or mitigations immediately.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-58049** affects FFmpeg’s RASC video decoder in `libavcodec/rasc.c`, where the `decode_dlta()` function performs 32-bit reads and writes before enforcing a row-boundary check. The flaw is compounded by validating the DLTA region in pixel units rather than byte units, allowing a crafted media stream using the RASC FourCC to access several bytes past a PAL8 frame row allocation. Security advisories say the bug can trigger a bitstream-controlled heap out-of-bounds write and an adjacent out-of-bounds read during decoding, leading to memory corruption and potential remote exploitation. A public proof of concept demonstrates the issue on FFmpeg upstream code and shows how DLTA run handlers can write past a 64-byte PAL8 frame row boundary. The PoC uses a custom buffer callback to place a function pointer next to the frame buffer, then overwrites the low bytes of that pointer through a crafted DLTA run to redirect execution, while AddressSanitizer reports a heap-buffer-overflow in `decode_dlta()`. Reported mitigations include updating FFmpeg, applying vendor patches, and moving row-boundary validation ahead of every 32-bit access with stricter checks such as ensuring `cx + 4 <= w * s->bpp`.
Jul 12, 2026