CVE-2026-112274

LowCVSS 3.7/10Last modified Oct 19, 2026

Description

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1122756.1Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image i CVE-2026-1122766.1Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying CVE-2026-1122776.5rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to CVE-2026-1122786.5rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP serv CVE-2026-1122796.5rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers CVE-2026-112284.3Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage CVE-2026-1122806.1libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap CVE-2026-1122816.1libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows CVE-2026-1122825.5VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applicat CVE-2026-1122835.5VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c th CVE-2026-1122843.3libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpec CVE-2026-1122854.3Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usag