CVE-2026-39199

LowCVSS 2.9/10Last modified Jun 22, 2026

Description

snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file.

Metrics

CVSS 3.1 2.9/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jun 17, 2026
Last modified
Jun 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-39208.8Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruptioCVE-2026-39218.8Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via CVE-2026-39228.8Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via aCVE-2026-392296.5Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level CVE-2026-39238.8Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a craCVE-2026-39247.5use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process toCVE-2026-392435.5decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. WheCVE-2026-392447.5adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntCVE-2026-392456.2decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDCVE-2026-392467.5decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), tCVE-2026-39254.3Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofingCVE-2026-392507.3An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend applicatio
CVE-2026-39199: Low severity, CVSS 2.9 | Vulnix