CVE-2026-16839

Affected products: IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1. Root cause: integer underflow in the IPv4 IP-options parser, exploitable remotely with no authentication. Impact: CVSS 9.4 (Critical) — high integrity/availability, low confidentiality. Exploitation status: no in-the-wild exploitation or ...

EUVD-2026-62728

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser...

CVE-2026-16839 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser...

CVE-2026-16834 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow...

EUVD-2026-62722

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow...

CVE-2026-16834

CVE-2026-16834 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . A remote attacker can trigger an integer underflow to cause a denial of service , with no authentication or user interaction required. The CNA-assigned CVSS 3.1 score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A...

CVE-2026-72367

A flaw was found in the Linux kernel's iomap subsystem. This vulnerability occurs due to an integer underflow when calculating iosize during concurrent file truncation operations. If a file is truncated while writeback is in progress, the iosize can wrap to a large value, leading to incorrect...

CVE-2026-65610

nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression homelen - 1 is promoted to signed int and becomes -1 an...

EUVD-2026-62399

nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression homelen - 1 is promoted to signed int and becomes -1 an...

USN-8649-1 libheif vulnerabilities

It was discovered that libheif had an integer underflow in the Fraction constructor when a clap transform was applied twice. An attacker could possibly use this issue to cause libheif to crash, resulting in a denial of service. CVE-2026-62289 It was discovered that libheif had an out-of-bounds re...

USN-8649-1: libheif vulnerabilities

It was discovered that libheif had an integer underflow in the Fraction constructor when a clap transform was applied twice. An attacker could possibly use this issue to cause libheif to crash, resulting in a denial of service. CVE-2026-62289 It was discovered that libheif had an out-of-bounds re...

BIT-POSTGRESQL-2026-16241 PostgreSQL ECPG integer underflow can crash the client

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This...

CVE-2026-72326

A flaw was found in the Linux kernel's CAKE Common Applications Kept Enhanced packet scheduler. This vulnerability arises from the incorrect handling of signed overhead values, which can lead to an integer underflow during packet length calculations. A negative effective length can then wrap to a...

CVE-2026-72225

A flaw was found in the Linux kernel's jbd2 journaling layer. An integer underflow vulnerability in the jbd2journalinitializefastcommit function occurs when validating journal capacity. This underflow can corrupt critical journal metadata, such as jlast, jfcfirst, and jfree, leading to a journal...

CVE-2026-49419

FreeBSD 15.0+ kernel contains a double-free bug in kern_jail_set() and kern_jail_get(): when the JAIL_AT_DESC flag is used, the caller's current prison reference is released before descriptor lookup, then released again on error paths. An unprivileged local user can trigger a prison reference cou...

PT-2026-78688

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description An integer underflow occurs during bounds checking, which could allow a remote authenticated attacker to overwrite adjacent memory. An integer underflow is a condition where a subtraction operation...

RHEL 8 : gstreamer1-plugins-good (RHSA-2026:56966)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56966 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

PT-2026-78362

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software stores the homelen variable as a uchar t, which limits its range to 0-255. An attacker capable of influencing the execution environment can provide a HOME path with a length that is truncated to 0. This...

CVE-2026-62289

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

CVE-2026-62289 libheif: Integer underflow in Fraction constructor via double clap transform application

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...