91265 matches found
CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
EUVD-2026-107172
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
Compress/s2: Integer Overflow Or Wraparound And Out-of-bounds Write In Compress
Signed Integer Overflow in s2.NewDict Summary A signed integer overflow vulnerability in "s2.NewDict" allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding "MaxInt64". When "Dict.Encode" is subsequently called, the overflowed...
CLSA-2026-1791800936 kernel: Fix of 191 CVEs
drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check CVE-2026-89818 - drm/amdgpu/vcn4: Avoid overflow on msg bound check CVE-2026-46199 - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg CVE-2026-46199 - drm/amdgpu/vcn3: Avoid overflow on msg bound check CVE-2026-46230 -...
DEBIAN-CVE-2026-105923
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...
CVE-2026-105923
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...
UBUNTU-CVE-2026-105923
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...
CVE-2026-105923
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...
Security update for poppler
This update for poppler fixes the following issues: CVE-2026-93313: JBIG2 stream processing can cause integer overflows bsc1282532. CVE-2026-93314: TrueType font processing can cause integer overflows bsc1282531. CVE-2026-102620: Data corruption via integer overflow in FoFiTrueType:cvtSfnts...
CVE-2026-112059
A flaw was found in liblas. By convincing a user to process a specially crafted LAS file containing an oversized schema record, an attacker can trigger an integer truncation issue during memory allocation. This flaw leads to a heap-based buffer overflow, causing an application crash or memory...
CVE-2026-105923 Null-pointer dereference in QTriangulator reachable through VectorImage
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...
EUVD-2026-107159
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...
CVE-2026-105923
The VectorImage QML Type is vulnerable to a null-pointer dereference caused by an integer overflow . This issue can be triggered by processing a malicious SVG file, which leads to an impact on availability . No specific exploit details or remediation versions are provided in the documents.
CVE-2026-105923
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...
BIT-PGBOUNCER-2026-107348 Integer overflow causes an infinite loop in message buffer growth in PgBouncer
Integer overflow in the message buffer growth logic mbufmakeroom in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when maxpacketsize is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow,...
CLSA-2026-1792571502 nginx: Fix of CVE-2026-97205
CVE-2026-97205: limit the number of pending operations per request so that the 8-bit r-main-blocked counter cannot overflow...
CVE-2026-111075
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...
CVE-2026-111074
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity causes the receiving...
CVE-2026-114045
A flaw was found in FreeRDP. An integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDCFORMATS PDUs, causing an unbounded heap write during server audio playback that may...