CVE-2026-55365

MediumCVSS 6.7/10Last modified Sep 21, 2026

Description

In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-553669.8In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalationCVE-2026-55376.3A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the fCVE-2026-553706.4Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a suCVE-2026-553716.9OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picturCVE-2026-553736.2OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions priCVE-2026-553744.8canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values retCVE-2026-553755.3canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_CVE-2026-553768.8Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user CVE-2026-553778.1Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted anCVE-2026-553789.3JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflowCVE-2026-553797.5Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file CVE-2026-55386.3A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer