CVE-2026-118435

MediumCVSS 5.4/10Last modified Nov 5, 2026

Description

Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
Samsung Open Sourceescargot—

References

Timeline

Published
Oct 28, 2026
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1184373.7The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthCVE-2026-1184386.8The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser,CVE-2026-1184394.1The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a useCVE-2026-118444.9The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged remCVE-2026-1184444.8Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nCVE-2026-1184456.9A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are expoCVE-2026-1184466.9A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrayCVE-2026-1184474.8A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. TCVE-2026-1184486.9A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, iCVE-2026-118457.2The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged reCVE-2026-1184505.9Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create filesCVE-2026-1184588.1The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fix
CVE-2026-118435: Medium severity, CVSS 5.4 | Vulnix