CVE-2026-72854 msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

msgpackunpackerexpandbuffer in src/unpack.c, reached through the public msgpackunpackerreservebuffer API, computes its new buffer size using an unchecked sizet addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the...

CVE-2026-72854

msgpack-c (C MessagePack library) is affected by an integer overflow in msgpack_unpacker_expand_buffer (src/unpack.c), reachable via the public msgpack_unpacker_reserve_buffer API. The doubling loop guards its multiplication against overflow, but the addition in the loop condition is unguarded , ...

CVE-2026-72854 msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

msgpackunpackerexpandbuffer in src/unpack.c, reached through the public msgpackunpackerreservebuffer API, computes its new buffer size using an unchecked sizet addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the...

CVE-2026-72852

hank-ai/darknet (a neural network framework) is affected by an integer overflow in src-lib/convolutional_layer.cpp that leads to a heap buffer overflow . Buffer sizes for convolutional layer weights and outputs are computed using unchecked 32-bit integer arithmetic on fields parsed from a .cfg fi...

EUVD-2026-63536

hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutionallayer.cpp, l.nweights is computed as c / groups n size size and l.outputs as l.outh l.outw l.outc, an...

CVE-2026-72852 darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow

hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutionallayer.cpp, l.nweights is computed as c / groups n size size and l.outputs as l.outh l.outw l.outc, an...

CVE-2026-63384

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

CVE-2026-63387

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check...

DEBIAN-CVE-2026-63384

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

EUVD-2026-63573

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptestchannel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has...

CVE-2026-77148

A stack-based buffer overflow was identified in the Web Management component of Comfast CF-N1-S firmware 2.6.0.1 . The vulnerable function is sub_44B50C within the endpoint /cgi-bin/mbox-config?method=SET&section=ptest_channel. The flaw allows a remote attacker with low privileges to trigger the ...

CVE-2026-77148 Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptestchannel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has...

EUVD-2026-63508

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check...

CVE-2026-63387

libevent <2.1.13 and

CVE-2026-63387 Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check...

CVE-2026-63387 Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check...

CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

CVE-2026-63384

CVE-2026-63384 is a denial-of-service vulnerability in Libevent , an event notification library, caused by an incorrect integer conversion in event_tagging.c. The function evtag_unmarshal_header decodes an attacker-controlled uint32 payload length via evtag_decode_int and returns it as a signed i...