CVE-2026-124758

P-Net versions before 1.0.4 are vulnerable to an integer underflow within IODWrite requests targeting non-user record indices. The software fails to validate the record data length against the record block header size. When a 32-bit length smaller than the header is processed, it underflows to ap...

RLSA-2026:97163 Moderate: mingw-glib2 security, bug fix, and enhancement update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: GLib: Buffer underflow...

CVE-2020-1349

CVE-2020-1349 This vulnerability occurs in Outlook 2019 16.0.12624.20424 installed on Korean Windows 10 1909 x64, codepage 949. TLDR; I have not been able to bypass aslr using this vulnerability, but I have written an outlook 2019 32bit exploit that pops up a calculator using the address of a...

CVE-2022-0185-Case-Study

CVE-2022-0185-Case-Study This case study is a result of an assignment of ECE 9069: Introduction to Hacking : https://whisperlab.org/introduction-to-hacking/ CVE-2022-0185 Overview CVE-2022-0185 is a heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesyst...

Urgent11-Suricata-LUA-scripts

Urgent11-Suricata-LUA-scripts Suricata LUA scripts to detect CVE-2019-12255, CVE-2019-12256, CVE-2019-12258, and CVE-2019-12260 CVE-2019-12255 The script checks for CVE-2019-12255, the packet that is checked needs to have the PSH, ACK, and URG flags set, and have a payload size that exceeds 1500...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

CVE-2026-42980-POC

CVE-2026-42980 Public Disclosure This repository contains the public disclosure material for CVE-2026-42980 , a Windows kernel WMI integer-underflow vulnerability that can be exploited for local privilege escalation to NT AUTHORITY\SYSTEM on vulnerable lab builds. Full write-up English article...

CVE-2026-25075-check

CVE-2026-25075 Vulnerability Assessment Tool Safely detect whether a strongSwan VPN server is vulnerable to CVE-2026-25075 without causing any disruption. See the full write-up at the Bishop Fox blog. Description CVE-2026-25075 is an integer underflow vulnerability in strongSwan's EAP-TTLS plugin...

CVE-2026-81000

⚡ CVE-2026-81000 - TUNderflow Linux Kernel TUN/TAP Receive Headroom Memory Corruption A Linux kernel memory-corruption vulnerability in the TUN/TAP networking subsystem , caused by insufficient bounds on receive headroom and an integer underflow in the packet allocation path. ⚠️ Disclaimer This...

Windows-CVE-2024-38063

Windows-TCP/IP-IPv6CVE-2024-38063 Vulnerability CVE-2024-38063 is a remote code execution vulnerability in the TCP/IP component of the Windows operating system. According to Microsoft's official description, the vulnerability has a maximum severity rating of Critical, with a CVSS score of 9.8, an...

busybox: busybox: udhcpc integer underflow in DHCP packet length calculation causes denial of service

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causin...

CVE-2026-84411

CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit Overview CVE-2026-84411 is a critical pre-authentication Remote Code Execution RCE vulnerability in MikroTik RouterOS. Field| Value ---|--- CVSS v3| 9.8 Critical CWE| CWE-191: Integer Underflow Attack Vector| Network...

CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...

CVE-2026-13270

Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-126957

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...

kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls

A flaw was found in the Linux kernel's s390/qeth component. This vulnerability allows a local attacker to trigger an integer underflow when handling user-supplied buffer lengths in the qethsnmpcommand and qethl3arpquery functions. This can lead to an out-of-bounds write, potentially causing memor...

CVE-2026-13270

Quest NetVault Backup is affected by an integer underflow vulnerability in the nvpmgr service, which listens on UDP port 20031 by default. The flaw stems from a lack of proper validation of user-supplied data, leading to an integer underflow before a buffer is allocated. This allows remote, unaut...

CVE-2026-13270 Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability

Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The specific flaw...

EUVD-2026-124156

Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-126957

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...