PyTorch Inductor CPU tiled reductions can overflow the heap
Full-width vector stores on tail blocks of 2D-tiled reductions corrupt memory or silently rewrite neighboring output rows.
By tensor#heap-overflow
glibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalueglibc patches heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted empty charset name overrun a heap buffer when opening files with character conversion.
By segfaultglibc patches heap overflow in fopen charset mode handling
CVE-2026-18374 let an empty ccs= mode string overflow a heap buffer; fopen now rejects it with EINVAL.
By rvalueglibc plugs heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultQEMU patches heap overflow in vhost-user-gpu backend
CVE-2026-15264 let a malicious guest overflow a host heap buffer via crafted 2D resource dimensions.
By sudoQEMU fixes guest-triggerable VGA heap overflow
A unit mismatch between text and graphics mode left a panning buffer undersized after mode switches, tracked as CVE-2026-17516.
By sudo