rootpwn

critical · CVSS v3 9.8 · CVSS v4 5.1

CVE-2026-79113

OpenAPV versions prior to 1.1.1.0 contain a heap-based buffer overflow in the read_bitstream function, allowing attackers to corrupt memory

Overview

OpenAPV versions prior to 1.1.1.0 contain a heap-based buffer overflow in the read_bitstream function, allowing attackers to corrupt memory and potentially execute arbitrary code. This flaw can be exploited remotely by sending crafted data to vulnerable systems. The vulnerability is critical, with a CVSS v3 score of 9.8.

Description

OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow.

Impact

The buffer overflow can lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the affected system. System administrators and security teams are directly impacted as they must address the vulnerability to protect infrastructure.

Remediation

Apply the official patch to upgrade to OpenAPV 1.1.1.0 or later. If patching is not immediately possible, restrict network access to the read_bitstream endpoint, disable the feature if unused, and enable memory protection mechanisms such as ASLR and stack canaries.

Risk context

The vulnerability is classified as critical with a CVSS v3 score of 9.8, indicating a high urgency for remediation. No EPSS score is available, but the severity alone warrants immediate action.

Affected products

  • OpenAPV

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
5.1
EPSS
—

buffer-overflow heap critical OpenAPV read_bitstream patch defense

← All CVEs

Related CVEs

critical

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

View analysis

critical

CVE-2026-105080

ConvertX versions prior to 0.19.0 allow recipe files to be passed directly to Calibre's ebook-convert program, enabling execution of arbitrary code contained in .recipe or .downloaded_recipe files. This flaw can be exploited by attackers who supply malicious recipe files to a vulnerable ConvertX instance. The vulnerability is critical and can lead to full compromise of affected systems.

View analysis

critical

CVE-2026-92536

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.

View analysis

critical

CVE-2026-97644

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.

View analysis