2077 matches found
PT-2026-63454
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
Summaryinternalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic:cwavbuf += nx ny wcount;Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path...
PT-2026-59486
Summary The DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated rowBlock backing store. This bug is reachable from the...
SUSE CVE-2026-38076
An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-58207
A flaw was found in NATS Server. A client with the ability to send account-scoped connection monitoring requests could crash the server. This is achieved by providing pagination offset and limit values that cause an arithmetic overflow, leading to a Denial of Service DoS. Mitigation Upstream...
C-exploitation-and-mitigation
C Memory-Safety & Exploit-Mitigations Three self-contained de...
CVE-2026-38076
A flaw was found in jbig2dec. An integer overflow vulnerability in the jbig2arithiaidctxnew function allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted input. This can lead to the affected system becoming unresponsive or crashing, disrupting its normal...
EUVD-2026-42767
An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...
DEBIAN-CVE-2026-38076
An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...
PT-2026-56992
Name of the Vulnerable Software and Affected Versions Artifex affected versions not specified Description An integer overflow occurs in the jbig2 arith iaid ctx new function. This flaw allows an attacker to trigger a Denial of Service DoS by providing a specially crafted input. Recommendations At...
CVE-2026-38076
The jbig2dec library, developed by Artifex Software , is vulnerable to an integer overflow in the jbig2_arith_iaid_ctx_new() function. This flaw exists in commit cc37d0 and can be triggered by a crafted input to cause a Denial of Service (DoS) . Affected systems include EulerOS 2.0 SP10, 2.0 SP12...
CVE-2026-38076
An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input...
The vulnerability of the drivers/gpu/drm/panthor components of the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the drivers/gpu/drm/ptorh components of the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-58470
GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...
OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute
SummaryThe OpenEXRCore code is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. DetailsIn the LossyDctDecoderexecute function from src/lib/OpenEXRCore/internaldwadecoder.h...
PYSEC-2026-1746 OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute
Summary The OpenEXRCore code is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. Details In the LossyDctDecoderexecute function from...
[SECURITY] Fedora 44 Update: leptonica-1.87.0-4.fc44
The library supports many operations that are useful on Document images Natural images Fundamental image processing and image analysis operations Rasterop aka bitblt Affine transforms scaling, translation, rotation, shear on images of arbitrary pixel depth Projective and bi-linear transforms Bina...
Integer Arithmetic Utilities for Image Buffer Sizing and Offset Validation
This C program demonstrates defensive programming techniques for preventing integer overflows during image-processing calculations by implementing reusable safe arithmetic helpers for addition, multiplication, buffer sizing, and offset validation...
PT-2026-57495
A record user with UPDATE access could read field values that field-level SELECT permissions hid from them. Arithmetic operators and extend embedded the raw operand into their error messages, and UPDATE permission checks evaluate against the unreduced document — so triggering such an error agains...
