chromium-browser: angle: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=487208468...

chromium-browser: angle: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=491760376...

chromium-browser: angle: chromium-browser: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=498400132...

chromium-browser: angle: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=485622239...

chromium-browser: angle: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=487977696...

chromium-browser: angle: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=489791424...

chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia

An integer overflow flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=495534710...

chromium-browser: angle: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497896137...

chromium-browser: angle: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=495363705...

chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia

An integer overflow flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=502636904...

chromium-browser: angle: chromium-browser: Integer overflow in ANGLE

An integer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=484986863...

CVE-2026-85498

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

EUVD-2026-112679

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

CVE-2026-85498 Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

CVE-2026-85498

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

BIT-RCLONE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

BIT-PILLOW-2026-96641 Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/imaging.c checks positive glyph advances against INTMAX but does not check negative advances against INTMIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in...

CVE-2026-98950

A flaw was found in the Linux kernel. A remote attacker could trigger a Denial of Service DoS or improper packet routing due to an integer truncation vulnerability within the Berkeley Packet Filter BPF flow dissector. When handling packets with header lengths exceeding 16-bit limits 65,535 bytes,...

CVE-2026-99004

A flaw was found in the Imagination Technologies GPU driver drm/imagination in the Linux kernel. An integer underflow in the driver's page table calculation can lead to a Denial of Service DoS. A local user can exploit this vulnerability when requesting memory mappings that cross page table...

CVE-2026-99182

A flaw was found in the Linux kernel's Sound Open Firmware SOF audio subsystem. When handling aggregated audio capture configurations where the channel count is smaller than the number of aggregated devices, an integer underflow occurs in the IPC4 topology driver. A local user could trigger this...