Logo
Retour à la veille

CVE-2026-86870

Publié : 14 septembre 2026
Modifié : 18 septembre 2026
Lien officiel NVD
Score CVSS
6.5
MEDIUM

Description détaillée

A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Références et Patchs

https://support.apple.com/en-us/149034https://support.apple.com/en-us/149035https://support.apple.com/en-us/149037https://support.apple.com/en-us/149038https://support.apple.com/en-us/149041

Dernières Vulnérabilités

CVE-2026-93959

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

VOIR DÉTAILS

CVE-2026-94084

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

VOIR DÉTAILS

CVE-2026-94083

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

VOIR DÉTAILS