ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104608)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104608 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as 1...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098742)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098742 advisory. In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9clientwrite and...

MiracleLinux 9 : pcp-6.3.7-8.el9_8.4 (AXSA:2026-1662:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1662:02 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

...

CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

EUVD-2026-64366

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74671: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

EUVD-2026-64138

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signe...

CVE-2026-70462

A flaw was found in rsync. A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely. This leads to...

CVE-2026-77219: Integer Overflow or Wraparound

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signe...

EUVD-2026-63507

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

AlmaLinux 9 : pcp (ALSA-2026:55740)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55740 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets PMDA...

CVE-2026-70628

A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV Windows Recorded TV Show file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence ...

pcp security update

An update is available for pcp. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Performance Co-Pilot PCP is a suite of tools, services, and libraries for...

SUSE CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

ANT-2026-3T6Q6WE9 · mpv · Heap Buffer Overflow

heap-buffer-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-3T6Q6WE9: Integer overflow in scaletempo audio filter...