UBUNTU-CVE-2026-6103

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

CVE-2026-6103

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

CVE-2026-10758

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker...

CVE-2026-10758 Esri Lerc has a security vulnerability

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker...

EUVD-2026-87360

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker...

CVE-2026-10758 Esri Lerc has a security vulnerability

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker...

CVE-2026-10758

The Esri LERC open-source image or raster format is vulnerable to a Heap based Out-of-Bounds Write caused by an Integer Overflow . This flaw affects LERC versions 4.1.0 and earlier . A remote, unauthenticated attacker can exploit this by providing specifically crafted imagery to an application us...

CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

EUVD-2025-211004

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181

A heap-based buffer overflow vulnerability exists in the PHP SOAP HTTP client during HTTP response parsing. The flaw stems from a buffer size check that relies on signed integer overflow , which is undefined behavior and can be optimized away by compilers. A malicious SOAP server can provide craf...

CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2026-100208

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

CVE-2026-6103

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

EUVD-2026-87322

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

CVE-2026-6103

The php language environment is vulnerable to an integer overflow in the phar_tar_number() function. The function fails to perform an overflow check when parsing the 11-octal-digit size field of a TAR header into a uint32_t. Consequently, sizes exceeding 0xFFFFFFFF silently wrap, causing the pars...

CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...