Windows-CVE-2024-38063

Windows-TCP/IP-IPv6CVE-2024-38063 Vulnerability CVE-2024-38063 is a remote code execution vulnerability in the TCP/IP component of the Windows operating system. According to Microsoft's official description, the vulnerability has a maximum severity rating of Critical, with a CVSS score of 9.8, an...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – libtiff TIFFReadRGBATileExt Analysis Overview This lab analyzes CVE-2023-52356 in libtiff, focusing on the behavior of TIFFReadRGBATileExt when it receives image coordinates outside the valid image bounds. The analysis includes reproduction of the original crash, debugging with...

CVE-2022-2869-detector

CVE-2022-2869 CodeQL Detector This project implements a general CodeQL detector for the root weakness behind CVE-2022-2869: an unsigned subtraction that may underflow because the program has not established a sufficient lower-bound/order guard before the arithmetic. Why this version is different...

CVE-2026-81000

⚡ CVE-2026-81000 - TUNderflow Linux Kernel TUN/TAP Receive Headroom Memory Corruption A Linux kernel memory-corruption vulnerability in the TUN/TAP networking subsystem , caused by insufficient bounds on receive headroom and an integer underflow in the packet allocation path. ⚠️ Disclaimer This...

CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...

retbleed-speculative-execution-poc

Retbleed: Arbitrary Speculative Code Execution via RSB Underflow A hands-on reproduction of Retbleed CVE-2022-29900 / CVE-2022-29901 — the 2022 micro-architectural attack that broke the "Retpoline" defense by proving that ret instructions, long assumed safe, can be hijacked when the CPU's Return...

CLSA-2026-1792990909 libexif: Fix of 3 CVEs

CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote entry value handling - CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote handling - CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size checks...

K000163890: Linux kernel vulnerabilities CVE-2026-46136 and CVE-2026-46138

Security Advisory Description CVE-2026-46136 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix a potential clc buffer length underflow The buflen is used to limit the iterations for retrieving the country power setting and may underflow under certain...

CVE-2026-25075-check

CVE-2026-25075 Vulnerability Assessment Tool Safely detect whether a strongSwan VPN server is vulnerable to CVE-2026-25075 without causing any disruption. See the full write-up at the Bishop Fox blog. Description CVE-2026-25075 is an integer underflow vulnerability in strongSwan's EAP-TTLS plugin...

CVE-2023-20938-poc

CVE-2023-20938 — Android binder UAF privilege escalation A local privilege escalation proof-of-concept for CVE-2023-20938 , a use-after-free in the Android binder driver. From an unprivileged shell it gains uid 0 and drops SELinux to permissive , then spawns a root shell. Target for this build:...

PHP-FPM Path Info Buffer Underflow - Remote Code Execution

In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgisplitpathinfo directive, a crafted request with an empty PATHINFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote...

CVE-2026-35330

CVE-2026-35330 strongSwan EAP-SIM / EAP-AKA attribute parser pre-auth heap buffer overflow via integer underflow. Description parseattributes in src/libsimaka/simakamessage.c:419 reads TLV headers whose length byte counts 4-byte words. For the ATRAND / ATENCRDATA branch: if hdr-length 4 in.len ||...

CVE-2026-27654-PoC

CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Handling PoC This repository provides a proof‑of‑concept exploit for CVE‑2026‑27654 , a heap‑overflow vulnerability in the ngxhttpdavmodule of nginx. The bug arises from a size‑t underflow when handling MOVE/COPY requests with specially craft...

CVE-2026-98839

A flaw was found in the Linux kernel's virtual terminal selection subsystem. When pasting console selections, a race condition can occur if another process concurrently replaces the selection buffer with shorter content while the operation is temporarily paused. This situation causes an integer...

OSEC-2026-21 Str partial-match stale capture registers underflow

ANT-2026-KKC4QS4S Str partial-match stale capture registers underflow Str.stringpartialmatch records the beginning and end of a captured group. There was an implicit assumption that beginning end. Str.matchedgroup is safe, it fails with an Invalidargument on groups with beginning end, but...

CVE-2023-25610

CVE-2023-25610 Heap memory underflow in the FortiOS management interface leads to remote code execution. Scope and Limitations 1. Fortinet 6.x 2. Based on TLSv1.3; may vary across other TLS versions Usage python3 cve-2022-42475.py rhost rport lhost 'command' python3 CVE-2023-25610.py 192.168.10.1...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

CLSA-2026-1792239628 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99062

The Linux kernel contains a vulnerability in the vsock/virtio component where virtio_transport_read_skb() incorrectly manages byte accounting. After a partial stream receive, the function dequeues a packet but passes the full pkt_len for both buf_used and peer credit counters, causing rx_bytes to...