Advisories

The get_all_models handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of key_builder=. In aiocache 0.12.3 (the pinned version), key= is a static cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided …

An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller (get_event_call) delivers execute:python / execute:tool events to a client-supplied session_id after only checking that the session is connected, never that it belongs to the requester. Combined with ydoc:document:join, which exposes the live socket ids of everyone in a shared note's collaboration room to any read-access participant, an attacker can target a …

Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This advisory consolidates two filings of the same flaw: …

An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected …

The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The expensive bcrypt comparison therefore made valid-account attempts respond significantly slower (~180 ms) than non-existent ones (~5 ms), so an unauthenticated attacker could enumerate valid accounts by measuring response …

The administrator-configured WEB_FETCH_FILTER_LIST (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch) matches hostnames incorrectly, so the filter can be bypassed.

The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (settings.ui.toolServers[].key), which is not available via standard user info APIs.

Heap-buffer-overflow READ (16 bytes) in Gemm_7_6::adapt_gemm_7_6() (onnx/version_converter/adapters/gemm_7_6.h:41) when ConvertVersion() processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses B_shape[1] without checking rank. On Release builds the OOB read is silent; ASan confirms 16-byte read past a 48-byte allocation.

1. Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes inflated to 16,000,000 characters (about 770:1; about 49 MB observed heap delta), and 200 unique IDs added 200 permanent cache entries. A legitimately shaped short ID remained about 1:1, while …

Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)

Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go text/template engine. That engine's function map exposes a cmd function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that …

node-tar (npm tar) contains an uncontrolled-recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. When a consumer calls tar.t(…) or tar.x(…) with a non-empty member-selection list, node-tar installs a filter that closes over the recursive mapHas (src/list.ts:33-44). mapHas walks an entry path upward one path.dirname() call per recursion with no segment cap. A single crafted tar with a GNU-L (or PAX-x) long-path header can deliver a path of …

A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service.

An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server's EventLoop thread to exhaust CPU resources and become unresponsive.

What kind of vulnerability is it? Who is impacted? Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype. Example: const mongoose = require('mongoose'); console.log('before:', Object.prototype.$fullPath); // undefined const User = mongoose.model('User', new mongoose.Schema({ name: String })); const malicious = JSON.parse('{"$set": {"proto.x": "anything"}}'); // attacker-controlled update const q = User.updateOne({}, {}); try { q._castUpdate(malicious); …

Kiota versions prior to 1.32.3 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients.

Kiota versions prior to 1.32.3 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients.

kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled static_template.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (<name>-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's response_semantics.static_template.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the …

kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled static_template.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (<name>-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's response_semantics.static_template.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the …

Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics static_template (or the adaptive-card extension x-ai-adaptive-card), the file reference is written into the generated manifest's response_semantics.static_template.file and is later resolved by the AI host relative to the plugin package. An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package …

Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.

Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.

kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand (and dependency name/version) as the tool's own recommended install command, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description: $ kiota info -d <attacker-spec> -l CSharp … Hint: use the install command to install the dependencies. Example: curl …

kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand (and dependency name/version) as the tool's own recommended install command, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description: $ kiota info -d <attacker-spec> -l CSharp … Hint: use the install command to install the dependencies. Example: curl …

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution

Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module …

Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module …

The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. description, default values, and property names) directly into PHP double-quoted string literals without properly escaping the $ character. Since PHP evaluates string interpolation expressions like "${expr}", "$var", and "{$obj->prop}" within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code …

The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. description, default values, and property names) directly into PHP double-quoted string literals without properly escaping the $ character. Since PHP evaluates string interpolation expressions like "${expr}", "$var", and "{$obj->prop}" within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code …

Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/–class-name — the zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with …

Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/–class-name — the zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with …

Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — …

Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — …

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off / len arguments passed to affected XXHash APIs. It does not affect the common case where only the contents of a …

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off / len arguments passed to affected XXHash APIs. It does not affect the common case where only the contents of a …

The pop array filter at src/filters/array.ts:91-95 allocates a full clone of its input array via […toArray(v)] but does not call this.context.memoryLimit.use(…) the way every other array-clone filter in the same file does (shift, unshift, compact, concat, reverse, sample, slice, map, sortBy, where, group_by, uniq). This silently disables the memoryLimit budget for {{ huge_array | pop }}, letting a template render allocate an O(N) clone of an attacker-influenced array regardless of …

The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop to block indefinitely. This affects the default new_host() configuration and requires no special setup on either side.

Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters. Encoded path traversal segments can cause the upstream URL to resolve to a different Kubernetes API endpoint after authorization.

ValidationHandler.Load() in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application …

openapi3filter.ValidateRequest contains a NULL-pointer-dereference denial of service: any unauthenticated client can crash the request-validation path with a single HTTP request. When an operation declares a content parameter (as opposed to a schema parameter) whose media type object has no schema, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own doc.Validate() accepts it — and the defect affects both OpenAPI 3.0.x …

Parsing a small YAML document can take exponential time. An application that calls load() or loadAll() on untrusted input can be hung by a payload under 200 bytes.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

When providing invalid arguments to the connected-components option an infinite loop will occur.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

Running an X11 import with a crafted window title can result in a heap buffer over-write.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.