Topic
Stack-based buffer overflows and related memory-safety defects in native application binaries, here CWE-121 in argument parsing.
Ridge Security disclosed CVE-2026-42542, a flaw that lets an unauthenticated attacker crash a TDengine server with one malformed packet on port 6030. A patch shipped in 3.4.1.6, and the only proven payoff is a crash.
Reality
The proof of concept in strukturag's advisory declares a 33800 by 63520 picture at 16-bit depth, wraps the signed size calculation, and lets fill_plane write 4,294,968,336 bytes into the undersized heap buffer.
Reality
Samsung lists 18 critical Google-side bugs plus 31 of its own, including heap overflows in DNG and JPEG decoding. The rollout starts with major flagships, so only the 2026-09-05 patch level tells a fleet owner who is actually covered.
Reality
CISA's advisory lists eight Pyramid Solutions development kits below v5.6.1 rather than any finished device, so the fix reaches plant floors only after each device maker rebuilds and ships firmware.
Reality
Databricks says an ordinary customer role could reach the unchecked array index. The repair went upstream into the open-source extension rather than into either fleet. That is the only version that helps anyone else.
Reality
CVE-2026-59086 yields code execution in Simcenter Femap and Nastran below V2606. The fix already exists; the engineering workstations that need it rarely sit inside the monthly cycle.
Reality