PT-2026-79992

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This...

PT-2026-78597

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description A remote attacker could cause a denial of service due to an integer underflow, which occurs when an arithmetic operation results in a value smaller than the minimum...

PT-2026-78688

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description An integer underflow occurs during bounds checking, which could allow a remote authenticated attacker to overwrite adjacent memory. An integer underflow is a condition where a subtraction operation...

CVE-2026-16834: Integer Overflow or Wraparound

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow...

CVE-2026-16839: Out-of-bounds Read

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser...

CVE-2026-58087: Integer Underflow (Wrap or Wraparound)

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

PT-2026-78362

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software stores the homelen variable as a uchar t, which limits its range to 0-255. An attacker capable of influencing the execution environment can provide a HOME path with a length that is truncated to 0. This...

ALSA-2026:56966 Moderate: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gst-plugins-good: gst-plugins-good: unbounded memory...

PT-2026-78601

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description An integer underflow in the IPv4 IP-options parser allows a remote attacker to obtain sensitive information. An integer underflow occurs when an arithmetic operation results...

RHEL 8 : gstreamer1-plugins-good (RHSA-2026:56966)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56966 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

Moderate: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gst-plugins-good: gst-plugins-good: unbounded memory...

CVE-2026-18102: Heap-based Buffer Overflow

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking...

CVE-2026-62289

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

CVE-2026-62289

libheif ≤1.23.0 applies clean aperture transformation twice via process_image_transformations_on_tiling(), causing integer underflow in Box_clap::left_rounded(0) that constructs Fraction(0xFFFFFFFF, 2). Debug builds abort on assertion; release builds produce corrupt crops. Fixed in 1.23.1; Debian...

EUVD-2026-62188

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

CVE-2026-62289 libheif: Integer underflow in Fraction constructor via double clap transform application

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

CVE-2026-62289 libheif: Integer underflow in Fraction constructor via double clap transform application

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

CVE-2026-62289

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

SUSE CVE-2026-68145

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

GO-2026-6170 WITHDRAWN: Malformed backend frame length causes panic in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose...