EUVD-2026-82624

A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly...

CVE-2026-93314

A signed integer overflow in the function FoFiTrueType::mapCodeToGID (file fofi/FoFiTrueType.cc) affects Freedesktop Poppler 26.07.0 . The overflow is triggered by manipulating the segCnt argument. The vulnerability is exploitable remotely with user interaction required and no privileges needed. ...

CVE-2026-93313

An integer overflow in the JBIG2Stream::readCodeTableSeg function of poppler/JBIG2Stream.cc affects Freedesktop Poppler 26.07.0 . The flaw can be triggered remotely and, per the CVSS 3.1 vector (UI:R), requires user interaction —likely via a crafted document. The vulnerability allows low impact t...

EUVD-2026-82614

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could ...

CVE-2026-93311

Freedesktop Poppler 26.07.0 contains an integer overflow in the SampledFunction::SampledFunction constructor (poppler/Function.cc), triggered by manipulation of the BitsPerSample argument. The vulnerability is reachable remotely over the network with low complexity and no required privileges, but...

CVE-2026-77412

A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send a specially crafted AMQP Advanced Message Queuing Protocol message with a malformed field length. This can cause an integer overflow, leading to a runtime panic in the client process. Consequently, the client...

CVE-2026-54571

ESPAsyncWebServer (an asynchronous HTTP/WebSocket server library for ESP32, ESP8266, RP2040, and RP2350) contains an integer overflow in its multipart/form-data parser (src/WebRequest.cpp). Prior to version 3.11.1, the _boundaryPosition variable is stored as an 8-bit value ; a remote request with...

EUVD-2026-80808

RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration...

CVE-2017-7529

CVE-2017-7529 Nginx バージョン 0.5.6 以降、1.13.2 までのバージョンは、nginx レンジフィルターモジュールの整数オーバーフローの脆弱性の影響を受けます。これにより、特別に細工されたリクエストで潜在的に機密性の高い情報が漏洩する可能性があります。 インストール $ git clone https://github.com/Shehzadcyber/CVE-2017-7529.git $ cd CVE-2017-7529 使用方法 $ python3 CVE-2017-7529.py URL $ python3 CVE-2017-7529.py...

CVE-2021-43229

CVE-2021-43229 ウォークスルー 公開情報 Windows NTFS の特権昇格の脆弱性 以下とは異なる: CVE-2021-43230 CVE-2021-43231 パッチ: 2021年12月14日 Twitter の @AravGarg3 によると、CVE-2021-43229 は悪用可能であり、整数オーバーフロー に関連しているようです。 ソース : https://twitter.com/AravGarg3/status/1479447843458863104 Windows 10 のバージョン...

-Exploit-CVE-2017-7529

-Exploit-CVE-2017-7529 CVE-2017-7529: Nginx バージョン 0.5.6 以降 1.13.2 以前は、nginx のレンジフィルターモジュールにおける整数オーバーフローの脆弱性の影響を受け、特別に細工されたリクエストによって潜在的に機密性の高い情報が漏えいするおそれがあります。 使い方 python3 cve-2017-7529.py...

CVE-2018-19788

CVE-2018-19788 CVE-2018-19788 PolicyKit バグの悪用 完全にパッチが適用された CentOS 7 インストールで PolicyKit バグを悪用する手順。 root@centos7 groupadd -g 4000000000 cve201819788 root@centos7 useradd -m -c "User With High UID" -u 4000000000 -g 4000000000 -s /bin/bash cve201819788 root@centos7 id cve201819788...

CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110-Kernel-EoP-PoC CVE-2025-54110 のPoC実装。Windowsのシステムコール NtQueryDirectoryObject におけるカーネルレベルの整数オーバーフロー脆弱性。 CVE-2025-54110 - Windows カーネル整数オーバーフロー解析 CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110 このリポジトリには、CVE-2025-54110 カーネル EoP 脆弱性の Crash-Only PoC...

CVE-2021-40346-POC

CVE-2021-40346-POC CVE-2021-40346 の整数オーバーフローにより HTTP スマグリングが可能になる 整数オーバーフローによる HTTP リクエストスマグリング 中国語分析：HAProxy リクエストスマグリング脆弱性（CVE-2021-40346）分析 参照: https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/ ビルド root@kitploit: git clone...

EUVD-2026-82096

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90435

CVE-2026-90435 affects the Linux kernel in the RDMA/mlx5 subsystem. The vulnerability resides in set_user_buf_size(), which computes the QP buffer size by left-shifting user-supplied rq.wqe_cnt and rq.wqe_shift as signed integers. A sufficiently large rq.wqe_cnt triggers a signed integer overflow...

CVE-2026-90246

An integer overflow in the Linux kernel's AppArmor subsystem, specifically in verify_tags(), allows a crafted policy blob to bypass a bounds check. The check computes i + cnt using u32 arithmetic , so a count near U32_MAX wraps the sum to zero, letting the inner loop read past the end of the allo...

EUVD-2026-81839

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

CVE-2026-90200

CVE-2026-90200 affects the Linux kernel NTFS3 filesystem driver (fs/ntfs3). In ntfs_init_from_boot(), the MFT cluster numbers (mlcn, mlcn2) read from the boot sector are validated via a u64 multiplication against the volume size. A sufficiently large value (e.g., near 2^62) causes the multiplicat...

EUVD-2026-81793

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...