CVE-2026-102027

An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled...

EUVD-2026-101352

An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled...

CVE-2026-102027 Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed

An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled...

ROS-20261009-73-0454

The vulnerability of DRM/V3D components in the Linux operating system is related to incorrect calculation of buffer sizes. Exploiting this vulnerability can allow a perpetrator to cause service interruptions...

ROS-20261005-73-0008

The vulnerability in rsync is related to incorrect calculation of the buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incorrect Calculation of Buffer Size (CVE-2026-43501)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid506010; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2026-47578

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer size calculation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure,...

EUVD-2026-90125

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer size calculation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure,...

CVE-2026-47578: Incorrect Calculation of Buffer Size

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer size calculation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure,...

ROS-20260930-73-0144

The vulnerability in the drivers/net/ethernet/google/gve/gveethtool.c and drivers/net/ethernet/google/gve/gvemain.c modules of the Linux operating system is related to incorrect calculation of buffer sizes. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel amdgpu_ib_get_value amdgpu_ib_set_value DoS

The vulnerabilities of the functions amdgpuibgetvalue and amdgpuibsetvalue in the drivers/gpu/drm/amd/amdgpu/amdgpuring.h module of the Linux operating system are related to incorrect calculation of buffer sizes. Exploiting these vulnerabilities can allow attackers to access protected information...

CVE-2026-95509 Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg formatting by an incorrect buffer size calculation, causing out-of-bounds reading...

CVE-2026-95509

The Qt for MCUs framework is vulnerable to an out-of-bounds read due to an incorrect buffer size calculation during String.arg() formatting. This issue specifically affects strings optimized for Latin-1 characters when displaying Latin-1 characters. The vulnerability can result in an out-of-bound...

CVE-2026-95509: Out-of-bounds Read

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg formatting by an incorrect buffer size calculation, causing out-of-bounds reading...

ROS-20260928-73-0118

The vulnerability of the functions ah6outputdone and ah6output in the Linux kernel’s net/ipv6/ah6.c file is related to incorrect calculation of buffer size. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260928-73-0070

The vulnerability of the sndusbendpointsetparams function in the sound/usb/endpoint.c module, which is part of Linux’s sound device support for USB devices, is related to incorrect calculation of buffer size. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

FFmpeg vf_swaprect Heap Buffer Overflow DoS

The vulnerability of the vfswaprect video filter in the FFmpeg multimedia library is related to incorrect calculation of the buffer size. Exploiting this vulnerability can allow attackers to corrupt memory, cause service failures, or execute arbitrary code...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : rsyslog vulnerability (USN-8786-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8786-1 advisory. It was discovered that rsyslog incorrectly calculated buffer sizes when replacing strings. A remote...

FFmpeg vf_floodfill Heap Buffer Overflow DoS

The vulnerability of the vffloodfill video filter in the FFmpeg multimedia library is related to incorrect calculation of the buffer size. Exploiting this vulnerability can allow an attacker to damage memory, cause service failures, or execute arbitrary code...

CVE-2026-88355

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in newexpr. For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeofteexpr but treats the returned allocation as a complete teexpr...