PT-2026-76319

Summary A single root cause in the CLAHE implementation — tile width/height becoming zero — produces two distinct but related unsafe behaviors. Vulnerabilities exists in the CLAHEImage function of ImageMagick’s MagickCore/enhance.c. 1. Unsigned integer underflow → out-of-bounds pointer arithmetic...

CVE-2026-63362: Integer Underflow (Wrap or Wraparound)

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet...

CVE-2026-13308 Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this...

CVE-2026-13308

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this...

CVE-2026-13308: Integer Underflow (Wrap or Wraparound)

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this...

Security Updates for Microsoft Malware Protection Engine (July 2026)

The Microsoft Malware Protection Engine installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Integer underflow wrap or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally. CVE-2026-55011 - Integ...

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32headerSize without first ensuring avp.Length = headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length CWE-770 unbounded allocation...

CVE-2026-51254

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

ALPINE-CVE-2026-62423

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

ALPINE-CVE-2026-62424

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

ALPINE-CVE-2026-62425

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

ALPINE-CVE-2026-42495

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

ALPINE-CVE-2026-42494

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

libXpm: libXpm: Denial of Service via unsigned integer underflow

A flaw was found in libXpm. An unsigned integer underflow vulnerability exists in the library's write path when processing image data. A local attacker could exploit this issue by convincing a user or application to process a specially crafted file, causing unbounded CPU and memory consumption th...

erlang/otp: erts: otp: Erlang/OTP: Denial of Service via integer underflow in ETF decoding

A flaw was found in Erlang/OTP. A remote attacker can exploit an integer underflow vulnerability in the External Term Format ETF decoder, specifically within the binarytoterm function. By sending a specially crafted ETF payload with a zero-length BITBINARYEXT tag, the attacker can trigger an...

Linux Distros Unpatched Vulnerability : CVE-2026-54890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer Underflow Wrap or Wraparound vulnerability in erlang otp erlang/otp erts modules, erlang otp erts erts modules allows Forced Integer Overflow, Excessive...

CVE-2026-54345: Integer Underflow (Wrap or Wraparound)

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...

CVE-2026-42495: Integer Underflow (Wrap or Wraparound)

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

PT-2026-65645

Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32headerSize without first ensuring avp.Length = headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length CWE-770 unbounded allocation...

CVE-2026-51254

...