72223 matches found
CVE-2026-59197 Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...
CVE-2026-10669 Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation
On Xtensa SoCs built with CONFIGXTENSAMPU and CONFIGUSERSPACE, archbuffervalidate in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 access permitted a...
CVE-2026-10669
Summary (CVE-2026-10669) : On Xtensa SoCs with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() erroneously permits access when the buffer size rounds to a wrap of the 32-bit address space, bypassing MPU checks. This can let an unprivileged user-thread validate or copy memory it sho...
Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally...
Remote Desktop Client Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network...
Microsoft Defender Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally...
Microsoft Defender Remote Code Execution Vulnerability
Integer underflow wrap or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally...
Windows DHCP Client Elevation of Privilege Vulnerability
Integer underflow wrap or wraparound in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network...
Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network...
Windows Terminal Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally...
Microsoft Word Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally...
Microsoft Excel Remote Code Execution Vulnerability
Integer underflow wrap or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
Microsoft Office Information Disclosure Vulnerability
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally...
Windows NTFS Remote Code Execution Vulnerability
Integer underflow wrap or wraparound in Windows NTFS allows an unauthorized attacker to execute code locally...
Windows Storage Spaces Direct Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack...
Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally...
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Resilient File System ReFS allows an authorized attacker to execute code locally...
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Integer underflow wrap or wraparound in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over an adjacent network...