CVE-2026-117608

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causi...

CVE-2026-118009

Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-117993

Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

EUVD-2026-111546

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...

CVE-2026-118370

Versions of libexpat through 2.9.0 are vulnerable to a signed integer overflow in the storeAtts() function located in lib/xmlparse.c. An attacker can supply a multi-gigabyte document featuring a start tag with more than 2^30 attributes, causing an overflow in attIndex and nPrefixes. This vulnerab...

CVE-2026-118370 libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...

CVE-2026-118370 libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...

CVE-2026-117608 Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causi...

CVE-2026-117608

Versions of Assimp through 6.0.5 are vulnerable to a heap out-of-bounds read caused by an integer overflow in MD2Importer::ValidateHeader(). An attacker can provide a malicious .md2 file with crafted numFrames and numVertices values that wrap the 32-bit size check, bypassing frame table bounds ch...

CVE-2026-117608 Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causi...

EUVD-2026-111543

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causi...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

CVE-2026-110747

ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

SUSE CVE-2026-118009

Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-104016

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

CVE-2026-110747 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...

CVE-2026-110747

ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...

CVE-2026-110747

The jackson-dataformat-protobuf library is vulnerable to an integer overflow in the ProtobufParser._readStringKey() method. When processing a protobuf map entry, the parser reads the length prefix of a string key into an attacker-controlled int and performs a bounds check using signed arithmetic....