PT-2026-64496

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Elan I2C touchpad driver contains issues related to how it processes physical dimensions and trace counts. If the device firmware or device tree provides zero values for the x traces...

CVE-2026-64275: Divide By Zero

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device...

OESA-2026-3134 jbig2dec security update

jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input.CVE-2026-38076...

PT-2026-64103

Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tga rle" Older affected Pillow versions u...

BIT-PILLOW-2026-59197 Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...

Security update for dash

This update for dash fixes the following issues CVE-2026-31323: arithmetic expansion evaluating INTMAXMIN / -1 can lead to a signed integer overflow and a denial of service bsc1269494. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3099-1 Security update for dash

This update for dash fixes the following issues - CVE-2026-31323: arithmetic expansion evaluating INTMAXMIN / -1 can lead to a signed integer overflow and a denial of service bsc1269494...

libsolv security update

0.7.33-5 - Fix a buffer overflow when decompressing solv pages CVE-2026-48864 RHEL-178270 0.7.33-4 - Cope with integer overflow in data size arithmetics in repoaddsolv CVE-2026-9149 RHEL-178267 0.7.33-3 - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository CVE-2026-91...

ROS-20260715-73-0004

The vulnerability of the modmd module in the Apache HTTP Server is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause resource exhaustion or server failures...

PT-2026-63454

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Summaryinternalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic:cwavbuf += nx ny wcount;Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path...

PT-2026-59486

Summary The DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated rowBlock backing store. This bug is reachable from the...

SUSE CVE-2026-38076

An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-58207

A flaw was found in NATS Server. A client with the ability to send account-scoped connection monitoring requests could crash the server. This is achieved by providing pagination offset and limit values that cause an arithmetic overflow, leading to a Denial of Service DoS. Mitigation Upstream...

C-exploitation-and-mitigation

C Memory-Safety & Exploit-Mitigations Three self-contained de...

CVE-2026-38076

A flaw was found in jbig2dec. An integer overflow vulnerability in the jbig2arithiaidctxnew function allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted input. This can lead to the affected system becoming unresponsive or crashing, disrupting its normal...

EUVD-2026-42767

An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...

DEBIAN-CVE-2026-38076

An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-38076

An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-56992

Name of the Vulnerable Software and Affected Versions Artifex affected versions not specified Description An integer overflow occurs in the jbig2 arith iaid ctx new function. This flaw allows an attacker to trigger a Denial of Service DoS by providing a specially crafted input. Recommendations At...