UBUNTU-CVE-2026-93395

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

CVE-2026-93395

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

CVE-2026-93395

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

CVE-2026-93395

CVE-2026-93395 is an integer underflow in the bson_new_from_buffer() function of libbson (the MongoDB C driver's BSON library). The function reads a 32-bit document length from input but fails to verify it is at least 5 (the minimum valid BSON document size). When the length field is zero , the e...

EUVD-2026-82471

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling

A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol RDP packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the...

FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling

A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol RDP packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the...

CVE-2026-90372 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss If a peer's VHT/HE MCS map has no supported spatial stream all fields 0x3, the loop exits with nss == 0 and the function returned u8-1 255, which was then written into...

CVE-2026-90274 coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of nrseqstate - 1 According to IHI006H Embedded Trace Macrocell Architecture Specification0, TRCSEQEVR is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0...

kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

A flaw was found in the Linux kernel's Internet Small Computer System Interface iSCSI Extensions for Remote Direct Memory Access RDMA iSER module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

Important: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

A flaw was found in the Linux kernel's Internet Small Computer System Interface iSCSI Extensions for Remote Direct Memory Access RDMA iSER module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow...

kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

A flaw was found in the Linux kernel's Internet Small Computer System Interface iSCSI Extensions for Remote Direct Memory Access RDMA iSER module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow...

kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

A flaw was found in the Linux kernel's Internet Small Computer System Interface iSCSI Extensions for Remote Direct Memory Access RDMA iSER module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow...

CVE-2026-93395: Integer Underflow (Wrap or Wraparound)

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

CVE-2026-89028

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a...