CVE-2026-91962 FreeRDP before 3.31.0 Integer Overflow via audin Apple backends

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

CVE-2026-91962 FreeRDP before 3.31.0 Integer Overflow via audin Apple backends

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

CVE-2026-91962

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length, triggering integer wraparound that leads to a double free and crashes the FreeR...

CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

EUVD-2026-78636

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960 FreeRDP before 3.31.0 Integer Overflow Double Free

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960 FreeRDP before 3.31.0 Integer Overflow Double Free

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel

Proof of Concept for a Linux kernel pr...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms

A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the pcre2compile32 function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denia...

Security Bulletin: Enterprise Content Managemant System Monitor for August 2026 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

Exploit for CVE-2026-59346

CVE-2026-59346 — VMXNET3 TSO Integer Overflow VMware Workstat...

kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

A flaw was found in the Linux kernel's Fibre Channel FC transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS Fabric Performance Incentive Notification Extended Link Service frame. This malformed frame...

SUSE-SU-2026:23740-1 Security update for pcre2

This update for pcre2 fixes the following issues: - CVE-2026-86145: missing size checks in pcre2dfamatch code can lead to an out-of-bounds write bsc1279893. - CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback bsc1280054. - CVE-2026-89157: out-of-bounds write via large...

SUSE-SU-2026:23840-1 Security update for pcre2

This update for pcre2 fixes the following issues: - CVE-2026-86145: missing size checks in pcre2dfamatch code can lead to an out-of-bounds write bsc1279893. - CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback bsc1280054. - CVE-2026-89157: out-of-bounds write via large...

kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

A flaw was found in the Linux kernel's Fibre Channel FC transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS Fabric Performance Incentive Notification Extended Link Service frame. This malformed frame...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: EDAC/bluefield: Fix potential integer overflow

In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of memctrlidx left-shifted 16 bits and OR-ed with DIMM index. With memctrlidx defined as 32-bits wide the left-shift...

kernel: EDAC/bluefield: Fix potential integer overflow

In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of memctrlidx left-shifted 16 bits and OR-ed with DIMM index. With memctrlidx defined as 32-bits wide the left-shift...