DEBIAN-CVE-2026-90199

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

AZL-102422 CVE-2026-90199 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

SUSE CVE-2026-91950

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdrdumppacket function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigg...

CVE-2026-90199

CVE-2026-90199 affects the Linux kernel's fs/ntfs3 filesystem driver in the mi_enum_attr() function. When the end virtual cluster number (evcn ) equals U64_MAX , the expression evcn + 1 wraps to zero, causing any start VCN to pass the boundary check. A malformed on-disk NTFS3 attribute with svcn ...

CVE-2026-90199 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

PT-2026-94593

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fbdev kyro driver where overlay viewport end coordinates are calculated using 32-bit unsigned arithmetic. Large input values can lead to integer wraparound before...

FreeBSD : mkvtoolnix -- Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound (a738c927-b216-11f1-bc39-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a738c927-b216-11f1-bc39-5404a68ad561 advisory. Moritz Bunkus reports: potential heap overflows/invalid memory access in the ODML index handling due to...

OPENSUSE-SU-2026:21867-1 Security update for mkvtoolnix

This update for mkvtoolnix fixes the following issues: Changes in mkvtoolnix: - CVE-2026-90783: heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic boo1280126...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

CVE-2026-91950

A flaw was found in FreeRDP, where an out-of-bounds read vulnerability exists in the rdpdrdumppacket function. This is due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a specially crafted RDPDR packet, bypassing security checks and causi...

CVE-2026-91950

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdrdumppacket function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigg...

DEBIAN-CVE-2026-91950

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdrdumppacket function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigg...

EUVD-2026-78807

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdrdumppacket function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigg...

CVE-2026-91950

FreeRDP versions before 3.31.0 contain an out-of-bounds read in the rdpdr_dump_packet function caused by a 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0, bypassing the bounds check and ...

Important: Red Hat Security Advisory: postgresql:16 security update

An update for the postgresql:16 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...