CVE-2026-89266

A flaw was found in stbvorbis, an open-source library for Ogg Vorbis decoding. This vulnerability, a heap buffer overflow, occurs in the startdecoder function due to an integer truncation error when allocating memory for codebook multiplicands. A remote attacker could exploit this by crafting a...

CVE-2026-89490

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

EUVD-2026-76770

stbvorbis through 1.22 contains a heap buffer overflow in startdecoder where the codebook multiplicands allocation size is truncated from sizet to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes...

DEBIAN-CVE-2026-89266

stbvorbis through 1.22 contains a heap buffer overflow in startdecoder where the codebook multiplicands allocation size is truncated from sizet to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes...

Linux Distros Unpatched Vulnerability : CVE-2026-18495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted...

CVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89490 ocfs2: fix readdir position truncation on 32-bit kernels

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89490

CVE-2026-89490 affects the ocfs2 filesystem in the Linux kernel on 32-bit systems. In ocfs2_dir_foreach_blk_el(), the directory position mask derived from sb->s_blocksize (a 32-bit unsigned long) is zero-extended to 64 bits when ANDed with the loff_t-typed ctx->pos, silently clearing the hi...

EUVD-2026-76166

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495

CVE-2026-18495 is a heap-buffer overflow in the tiff2pdf utility within libtiff , triggered by an integer truncation error when processing a crafted BigTIFF file. A 64-bit StripByteCounts value is truncated to 32 bits, causing an undersized memory allocation followed by an out-of-bounds copy, lea...

CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495 Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

PT-2026-90527

stb vorbis through 1.22 contains a heap buffer overflow in start decoder where the codebook multiplicands allocation size is truncated from size t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process...

CVE-2026-59985

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted RLE-compressed EXR image, which causes a 64-bit unpacked size to truncate before memory allocation. This leads to a heap out-of-bounds read when unpack32bit attempts to read beyond the allocated buffer. Successful...

CVE-2026-59984

A flaw was found in OpenEXR. When processing a specially crafted B44-compressed EXR image, an out-of-bounds write can occur due to an integer truncation vulnerability in ILP32 builds. This allows an attacker to cause a denial of service or potentially lead to memory corruption. Mitigation Red Hat...

CVE-2026-80710

A flaw was found in the Linux kernel's s390/dasd component. An integer truncation vulnerability in the dasdeckdcheckdeviceformat function can lead to an undersized buffer allocation. This allows a local attacker to write past the end of the allocated buffer, potentially causing memory corruption...

CVE-2026-80672

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability arises from an integer truncation error when validating the size of the $LogFile restart area and its log client record array. An attacker can exploit this by mounting a specially crafted NTFS image, leading to an...

CVE-2026-82457

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uidt and gidt, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target...

EUVD-2026-68104

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uidt and gidt, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target...