PT-2026-97338

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0 Description A signed integer overflow exists in libavformat/mov.c. In the mov read ispe function, uint32 t width and height values from a crafted HEIF ispe box are stored in signed int fields without bounds checkin...

AlmaLinux 10 : libarchive (ALSA-2026:69553)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69553 advisory. libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header CVE-2026-15028 libarchive: libarchive: Signed Integer...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1

Summary webkit2gtk3-jsc, gstreamer1-plugins-base, libtiff, and giflib are bundled with IBM Optim as part of its base OS image; Eclipse Jetty jetty-io is used for HTTP server infrastructure; Apache ZooKeeper zookeeper is used for distributed coordination; Jackson Core jackson-core is used for JSON...

RHEL 10 : libarchive (RHSA-2026:69553)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69553 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660...

CVE-2026-90435

CVE-2026-90435 is an integer overflow vulnerability in the Linux kernel's RDMA/mlx5 subsystem. The function set_user_buf_size() left-shifts user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers ; a sufficiently large rq.wqe_cnt triggers signed integer overflow (undefined behavior), ...

openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21839-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21839-1 advisory. Changes in gimp: - CVE-2026-66757: Fixed signed integer overflow in file-sgi causes the plugin to crash when RLE- compressed SGI images are processed...

TencentOS Server 4: tesseract (TSSA-2026:1010)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1010 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fixed an issue of signed integer overflow in l2tpip6sendmsg. When len = INTMAX - transhdrlen, the value of ulen = len + transhdrlen will cause an overflow. To address this issue, we can follow the approach used by udpv6 and...

Linux Distros Unpatched Vulnerability : CVE-2026-89612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMi...

CVE-2026-54241 libde265: SAO sequential filter heap buffer overflow via signed integer overflow

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an...

CVE-2026-54240

libde265 , an open-source H.265/HEVC video codec library, is affected by a signed integer overflow in its pixel accessor. Versions prior to 1.1.1 use signed 32-bit arithmetic to compute pixel offsets; a crafted HEVC stream with large image dimensions can overflow this value, causing out-of-bounds...

UBUNTU-CVE-2026-89612

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107291)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107291 advisory. In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed...

ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...

CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

EUVD-2026-75021

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: wget (UTSA-2026-106776)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106776 advisory. GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote...

Linux Distros Unpatched Vulnerability : CVE-2026-18355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the...