deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11314
Published: 2025-10-06
Description: A vulnerability has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected is the function findRolePage of the file findSingConfigPage.do. Such manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-6.md; https://vuldb.com/?ctiid.327195; https://vuldb.com/?id.327195
CVE: CVE-2025-11315
Published: 2025-10-06
Description: A vulnerability was found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this vulnerability is the function findUserPage of the file findUserPage.do. Performing manipulation of the argument sort results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-7.md; https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-7.md#3-proof-of-concept-poc; https://vuldb.com/?ctiid.327196
CVE: CVE-2025-29192
Published: 2025-10-06
Description: Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/FlowiseAI/Flowise/pull/4905; https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5; https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7r4h-vmj9-wg42
CVE: CVE-2025-50538
Published: 2025-10-06
Description: Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/FlowiseAI/Flowise/pull/4905; https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5; https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-964p-j4gg-mhwc
CVE: CVE-2025-11316
Published: 2025-10-06
Description: A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of the file findCategoryPage.do. Executing manipulation of the argument tenantId can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-8.md; https://vuldb.com/?ctiid.327197; https://vuldb.com/?id.327197
CVE: CVE-2025-11317
Published: 2025-10-06
Description: A vulnerability was identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findRolePage of the file findSingConfigPage.do. The manipulation of the argument sort leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-9.md; https://vuldb.com/?ctiid.327198; https://vuldb.com/?id.327198
CVE: CVE-2025-11318
Published: 2025-10-06
Description: A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file uploadWxFile.do. The manipulation of the argument File results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-10.md; https://vuldb.com/?ctiid.327199; https://vuldb.com/?id.327199
CVE: CVE-2025-11319
Published: 2025-10-06
Description: A weakness has been identified in nahiduddinahammed Hospital-Management-System-Website up to e6562429e14b2f88bd2139cae16e87b965024097. This issue affects some unknown processing of the file /delete.php. This manipulation of the argument ai causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/mhszed/Report/blob/main/SQL%20Injection%20Vulnerability%20in%20the%20Hospital-Management-System-Website%20Editor.docx; https://vuldb.com/?ctiid.327200; https://vuldb.com/?id.327200
CVE: CVE-2025-11320
Published: 2025-10-06
Description: A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/education/core/controller/UploadController.java. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E5%89%8D%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md; https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E5%89%8D%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md#vulnerability-reproduction; https://vuldb.com/?ctiid.327201
CVE: CVE-2025-11321
Published: 2025-10-06
Description: A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-639
References: https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%832.md; https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%832.md#vulnerability-reproduction; https://vuldb.com/?ctiid.327202
CVE: CVE-2025-11322
Published: 2025-10-06
Description: A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-521
References: https://github.com/marcelomulder/CVE/blob/main/NovoSga/CVE-2025-11322.md; https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md; https://vuldb.com/?ctiid.327203
CVE: CVE-2025-11323
Published: 2025-10-06
Description: A vulnerability was determined in UTT 1250GW up to v2v3.2.2-200710. Affected is the function strcpy of the file /goform/formUserStatusRemark. This manipulation of the argument Username causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/DavCloudz/cve/issues/3; https://vuldb.com/?ctiid.327206; https://vuldb.com/?id.327206
CVE: CVE-2025-57781
Published: 2025-10-06
Description: The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jvn.jp/en/jp/JVN95806263/; https://www.denso-ten.com/jp/information/topics/2025/1002
CVE: CVE-2025-9703
Published: 2025-10-06
Description: The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/4332d49b-d58c-4728-afab-6757ff9e43ee/
CVE: CVE-2025-9710
Published: 2025-10-06
Description: The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
CVSS Score: 6.3 (MEDIUM)
References: https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df/
CVE: CVE-2025-11324
Published: 2025-10-06
Description: A vulnerability was identified in Tenda AC18 15.03.05.19(6318). Affected by this vulnerability is an unknown functionality of the file /goform/setNotUpgrade. Such manipulation of the argument newVersion leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/setNotUpgrade.md; https://vuldb.com/?ctiid.327207; https://vuldb.com/?id.327207
CVE: CVE-2025-11325
Published: 2025-10-06
Description: A security flaw has been discovered in Tenda AC18 15.03.05.19(6318). Affected by this issue is some unknown functionality of the file /goform/fast_setting_pppoe_set. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/fast_setting_pppoe_set.md; https://vuldb.com/?ctiid.327208; https://vuldb.com/?id.327208
CVE: CVE-2025-58578
Published: 2025-10-06
Description: A user with the appropriate authorization can create any number of user accounts via an API  endpoint  using  a  POST  request.  There  are  no  quotas,  checking  mechanisms  or restrictions to limit the creation.
CVSS Score: 3.8 (LOW)
CWE: CWE-770
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58579
Published: 2025-10-06
Description: Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58580
Published: 2025-10-06
Description: An API  endpoint  allows  arbitrary  log  entries  to  be  created  via  POST request.  Without sufficient  validation  of the  input data, an attacker  can create manipulated log entries and thus falsify or dilute logs, for example.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-117
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58581
Published: 2025-10-06
Description: When an error occurs in the application a full stacktrace is  provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58582
Published: 2025-10-06
Description: If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58583
Published: 2025-10-06
Description: The  application  provides  access  to  a  login  protected  H2  database for  caching  purposes. The username is prefilled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58584
Published: 2025-10-06
Description: In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-598
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58585
Published: 2025-10-06
Description: Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58586
Published: 2025-10-06
Description: For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58587
Published: 2025-10-06
Description: The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58589
Published: 2025-10-06
Description: When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of the application.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58590
Published: 2025-10-06
Description: It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-58591
Published: 2025-10-06
Description: A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-9913
Published: 2025-10-06
Description: JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-9914
Published: 2025-10-06
Description: The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-288
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-11326
Published: 2025-10-06
Description: A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMacFilterSet. Executing a manipulation of the argument wifi_chkHz can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WifiMacFilterSet.md; https://vuldb.com/?ctiid.327209; https://vuldb.com/?id.327209
CVE: CVE-2025-11327
Published: 2025-10-06
Description: A security vulnerability has been detected in Tenda AC18 15.03.05.19(6318). This vulnerability affects unknown code of the file /goform/SetUpnpCfg. The manipulation of the argument upnpEn leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/SetUpnpCfg.md; https://vuldb.com/?ctiid.327210; https://vuldb.com/?id.327210
CVE: CVE-2025-59728
Published: 2025-10-06
Description: When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below [0], it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is not an empty string, it is assigned to root_url at [1].If the last (non-NUL) byte in this buffer is not '/' then we append '/' in-place at [2]. This will write two bytes into the buffer, starting at the last valid byte in the buffer, writing the NUL byte beyond the end of the allocated buffer.
We recommend upgrading to version 8.0 or beyond.
CWE: CWE-787
References: https://issuetracker.google.com/433502298
CVE: CVE-2025-59729
Published: 2025-10-06
Description: When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer.

If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000.

The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calculate end_pos based on a 32-bit offset read from the buffer.

There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation.

We recommend upgrading to version 8.0 or beyond.
CWE: CWE-787
References: https://issuetracker.google.com/433513232
CVE: CVE-2025-59730
Published: 2025-10-06
Description: When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it.

Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the resolution.

This codec can encode the frame contents using a run-length encoding algorithm. There are no checks that the decoded frame fits in the allocated buffer, leading to a heap-buffer-overflow.

process_frame_obj initializes the buffers based on the frame resolution:



We recommend upgrading to version 8.0 or beyond.
CWE: CWE-787
References: https://issuetracker.google.com/434637586
CVE: CVE-2025-59731
Published: 2025-10-06
Description: When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data.

We read rle_raw_size from the input file at [0], we decompress and decode into the buffer td->rle_raw_data of size rle_raw_size at [1], and then at [2] we will access entries in this buffer up to (td->xsize - 1) * (td->ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size.




We recommend upgrading to version 8.0 or beyond.
CWE: CWE-787
References: https://issuetracker.google.com/436510153
CVE: CVE-2025-59732
Published: 2025-10-06
Description: When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8.

If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write until the next multiple of 8.

The buffer td->uncompressed_data is allocated in decode_block based on the precise height and width of the image, so the "rounded-up" multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2] can corrupt following heap memory.



We recommend upgrading to version 8.0 or beyond.
CWE: CWE-787
References: https://issuetracker.google.com/436510316
CVE: CVE-2025-59733
Published: 2025-10-06
Description: When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type (and size), and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing code can be found in decode_header. The buffer td->uncompressed_data is allocated in decode_block based on the xsize, ysize and computed current_channel_offset.

The function dwa_uncompress then assumes at [5] that if there are 4 channels, these are "B", "G", "R" and "A", and in the calculations at [6] and [7] that all channels are of the same type, which matches the type of the main color channels.

If we set the main color channels to a 4-byte type and add duplicate or unknown channels of the 2-byte EXR_HALF type, then the addition at [7] will increment the pointer by 4-bytes * xsize * nb_channels, which will exceed the allocated buffer.





We recommend upgrading to version 8.0 or beyond.
CWE: CWE-787
References: https://issuetracker.google.com/436511754