72244 matches found
SUSE CVE-2026-86139
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...
SUSE CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...
CVE-2026-88914
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...
coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values
A flaw was found in GNU coreutils, specifically in the unexpand utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when unexpand processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing...
ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file
A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...
OSEC-2026-18 Marshal integer overflow leads to out-of-heap read
An integer overflow in the length-validation logic of OCaml's Marshal deserializer allows a crafted serialized object to bypass all bounds checks added by the CVE-2026-28364 fix, producing heap out-of-bounds reads from Marshal.frombytes / Marshal.fromstring and the C API camlinputvaluefromblock...
PYSEC-2026-3935 vLLM: Cross-User Data Leak Vulnerability
Summary An integer overflow in the actandmulkernel kernel can cause the output of one user request to be incorporated into the response of another request within the same inference batch. Under certain conditions, the last request in a batch can receive a partial or complete copy of the first...
vLLM: Cross-User Data Leak Vulnerability
SummaryAn integer overflow in the actandmulkernel kernel can cause the output of one user request to be incorporated into the response of another request within the same inference batch. Under certain conditions, the last request in a batch can receive a partial or complete copy of the first user...
kernel: sctp: validate stream count in sctp_process_strreset_inreq()
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. When processing a Stream Reset Incoming Request RESETINREQUEST from a peer, the kernel does not properly validate the stream count. This can lead to an integer overflow when calculating the size for t...
kernel: sctp: validate stream count in sctp_process_strreset_inreq()
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. When processing a Stream Reset Incoming Request RESETINREQUEST from a peer, the kernel does not properly validate the stream count. This can lead to an integer overflow when calculating the size for t...
PatchHawk-PoC
PatchHawk Proofs of Concept This repository publishes vulnera...
SUSE CVE-2026-86289
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public...
SUSE CVE-2026-87630
Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-87643
Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CLEANSTART-2026-HA46232 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Multiple security vulnerabilities affect the metallb package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...
Integer Overflow or Wraparound
Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in StompSubframeDecoder.java, where getContentLength accepts an unbounded long while alreadyReadChunkSize is an int, and the truncating cast at line 149 wraps a value above Integer.MAXVALUE to a negative...
Adobe Photoshop DCM JPEG-LS Image Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DIC...
CVE-2026-88035: Integer Overflow or Wraparound
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...
Unity Linux 20.1060a Security Update: glib2 (UTSA-2026-071902)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-071902 advisory. A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection...
Adobe Photoshop Integer Overflow RCE
The vulnerability of the Adobe Photoshop graphic editor is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to execute arbitrary code...