CVE-2026-102714

nxicmpv6validateoptions scans the option area with while length 2 common/src/nxicmpv6validateoptions.c:79. An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns NXSUCCESS. Its zero-length rejection never...

CVE-2026-35330

CVE-2026-35330 strongSwan EAP-SIM / EAP-AKA attribute parser pre-auth heap buffer overflow via integer underflow. Description parseattributes in src/libsimaka/simakamessage.c:419 reads TLV headers whose length byte counts 4-byte words. For the ATRAND / ATENCRDATA branch: if hdr-length 4 in.len ||...

Exploit for Integer Underflow (Wrap or Wraparound) in Microsoft

CVE-2024-38063: Exploitation, Detection & Mitigation Lab O...

CVE-2026-97413

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. A malicious client can trigger an integer underflow by sending a specially crafted message with an oversized length field during read or write operations. This improper validation leads to an out-of-bounds memory...

MikroTik RouterOS

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize...

PT-2026-102912

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS affected versions not specified Description A critical pre-authentication integer underflow allows unauthenticated attackers to execute arbitrary code with root privileges. An integer underflow occurs when an arithmetic...

Ubuntu 18.04 LTS / 24.04 LTS : catdoc vulnerabilities (USN-8838-1)

The remote Ubuntu 18.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8838-1 advisory. It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could...

SUSE CVE-2026-93784

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

CVE-2026-97551

A flaw was found in the Linux kernel's XFS file system. A local user can trigger a Denial of Service DoS by forcing an unexpected filesystem shutdown. When updating parent pointer attributes, the kernel fails to properly initialize the block reservation counter, causing an integer underflow durin...

CVE-2026-18747 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

CVE-2026-18747

The MCUmgr SMP-over-console transport in the Zephyr RTOS (specifically affecting CONFIG_MCUMGR_TRANSPORT_UART and CONFIG_MCUMGR_TRANSPORT_SHELL) is vulnerable to an integer underflow in mcumgr_serial_process_frag(). The system fails to properly validate declared packet lengths of 0 or 1; when the...

kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math

A flaw was found in the Linux kernel's Soft-iWARP siw component for Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted iWARP Fast Path Data Unit FPDU with a manipulated length field. This manipulation causes an integer underflow, leading to a use-after-free...

Urgent11-Suricata-LUA-scripts

Urgent11-Suricata-LUA-scripts Suricata LUA scripts to detect CVE-2019-12255, CVE-2019-12256, CVE-2019-12258, and CVE-2019-12260 CVE-2019-12255 The script checks for CVE-2019-12255, the packet that is checked needs to have the PSH, ACK, and URG flags set, and have a payload size that exceeds 1500...

USN-8838-1 catdoc vulnerabilities

It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could possibly use this issue to cause catdoc to crash or execute arbitrary code. CVE-2024-48877 It was discovered that catdoc had an integer overflow when...

USN-8838-1: catdoc vulnerabilities

It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could possibly use this issue to cause catdoc to crash or execute arbitrary code. CVE-2024-48877 It was discovered that catdoc had an integer overflow when...

CVE-2020-1349

CVE-2020-1349 This vulnerability occurs in Outlook 2019 16.0.12624.20424 installed on Korean Windows 10 1909 x64, codepage 949. TLDR; I have not been able to bypass aslr using this vulnerability, but I have written an outlook 2019 32bit exploit that pops up a calculator using the address of a...

CVE-2026-93789

A flaw was found in the Linux kernel's iwlwifi driver. This vulnerability allows a local user capable of loading custom firmware to cause a Denial of Service DoS through a system crash. The issue stems from insufficient bounds checking when parsing aligned Type-Length-Value TLV data blocks within...

CVE-2026-94287

A flaw was found in libXpm. An unsigned integer underflow vulnerability exists in the library's write path when processing image data. A local attacker could exploit this issue by convincing a user or application to process a specially crafted file, causing unbounded CPU and memory consumption th...

CVE-2022-0185-POC

CVE-2022-0185 — Proof of Concept A proof-of-concept exploit for CVE-2022-0185 , a heap-based buffer overflow in the Linux kernel's legacyparseparam function fs/fscontext.c. This allows a local unprivileged user to escalate privileges to root. Original exploit by Crusaders of Rust. Full writeup:...

SUSE SLES16 Security Update : liboqs (SUSE-SU-2026:23313-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23313-1 advisory. Changes in liboqs: Updated to 0.16.0: Deprecation notice: - SPHINCS+ was removed in 0.16.0. Security issues: - Fixed uninitialized...