71164 matches found
BIT-POSTGRESQL-2026-14662 PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These...
CVE-2026-72352
A flaw was found in the Linux kernel's Human Interface Device HID Berkeley Packet Filter BPF component. An integer overflow, where a calculation exceeds the maximum value an integer type can store, in the hidbpfgetdata function's range check can occur when processing a very large size value. This...
CVE-2026-49430
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
CVE-2026-49430 Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
EUVD-2026-62240
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
CVE-2026-49430
CVE-2026-49430 is a kernel memory corruption vulnerability in the OpenZFS component of FreeBSD , specifically in the ZFS_IOC_RECV_NEW ioctl within the heal receive path. The root cause is an integer truncation : a 64-bit payload size is truncated to 32 bits for buffer allocation, but the original...
CVE-2026-72326
A flaw was found in the Linux kernel's CAKE Common Applications Kept Enhanced packet scheduler. This vulnerability arises from the incorrect handling of signed overhead values, which can lead to an integer underflow during packet length calculations. A negative effective length can then wrap to a...
CVE-2026-72225
A flaw was found in the Linux kernel's jbd2 journaling layer. An integer underflow vulnerability in the jbd2journalinitializefastcommit function occurs when validating journal capacity. This underflow can corrupt critical journal metadata, such as jlast, jfcfirst, and jfree, leading to a journal...
CVE-2026-72068
A flaw was found in the Linux kernel's posix-cpu-timers component on 32-bit systems. An integer truncation vulnerability occurs in the updaterlimitcpu function when converting the RLIMITCPU value to nanoseconds. This issue causes the process CPU timer to be programmed to fire prematurely for...
kernel: dm log: fix out-of-bounds write due to region_count overflow
A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...
PT-2026-78688
Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description An integer underflow occurs during bounds checking, which could allow a remote authenticated attacker to overwrite adjacent memory. An integer underflow is a condition where a subtraction operation...
Linux Distros Unpatched Vulnerability : CVE-2026-74964
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird...
PT-2026-78697
Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.15.0 Description An unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field between 65520 and 65532. This causes the len variable in the stun get message len str function to wra...
PT-2026-78528
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit b4c199c Description An incorrect integer narrowing conversion exists in the AV1 RTP packetizer within libavformat/rtpenc av1.c. The OBU Open Bitstream Unit size is cast to long before being compared to the...
UBUNTU-CVE-2026-74988
Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird...
PT-2026-78669
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description An integer overflow allows a remote attacker to execute arbitrary code. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is...
PT-2026-78369
Name of the Vulnerable Software and Affected Versions cgltf versions prior to 1.16 Description An integer overflow exists in the non-sparse accessor bounds check within the cgltf validate function. A remote attacker can exploit this by providing malformed .gltf or .glb files with specially crafte...
CVE-2026-74964
Integer overflow in the Graphics component. This vulnerability was fix...
RHEL 8 : gstreamer1-plugins-good (RHSA-2026:56966)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56966 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...