PT-2026-61881

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description An integer overflow exists in the JavaScript: WebAssembly component. An integer overflow occu...

Oracle Linux 10 : gstreamer1-plugins-good (ELSA-2026-36675)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36675 advisory. 1.26.7-2.1 - Fix integer overflow vulnerabilities in wavpack decoder CVE-2026-53705 Resolves: RHEL-184480 Tenable has extracted the preceding description bloc...

CVE-2026-47714: Integer Overflow or Wraparound

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in libheif/region.cc contains an integer overflow. Both width and height are unsigned int 32-bit values parsed from the HEIF file. Their product can exceed UINT32MAX, wrapping to...

CVE-2026-16416: Integer Overflow or Wraparound

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

CVE-2026-16402: Integer Overflow or Wraparound

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16389: Integer Overflow or Wraparound

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16395: Integer Overflow or Wraparound

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16517: Integer Overflow or Wraparound

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

PT-2026-63256

Name of the Vulnerable Software and Affected Versions libarchive affected versions not specified Description A signed integer overflow occurs in the ZIP writer. Within the archive write zip header function in archive write set format zip.c, when ZIP encryption is active and the entry file size is...

Microsoft Office Integer Overflow RCE

The vulnerability of the Microsoft Office package is related to a numerical overflow vulnerability. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

pacemaker security update

2.1.10-3.0.1 - Replace bug url Orabug: 34202300 - Upstream reference in pacemaker crmreport binary Orabug: 32825154 2.1.10-3 - Fix integer overflows in remote message decompression code CVE-2026-10649 - Resolves: RHEL-181150...

EulerOS Virtualization 2.10.1 : libssh2 (EulerOS-SA-2026-2827)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the fi...

Oracle Linux 10 : rsync (ELSA-2026-19152)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19152 advisory. - Resolves: RHEL-174929 - TOCTOU symlink race condition CVE-2026-29518 - Resolves: RHEL-174949 - Memory disclosure via int overflow CVE-2026-43618 Tenable has...

EulerOS Virtualization 2.12.0 : openjpeg2 (EulerOS-SA-2026-2789)

According to the versions of the openjpeg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library...

EulerOS Virtualization 2.12.0 : libssh2 (EulerOS-SA-2026-2783)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the fi...

CVE-2026-47251: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 commit b97c8b5, PR 1712 introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the compressed-token decoding process. An attacker can access sensitive information such as environment variables, passwords, and memory pointers by sending specially crafted data to trigger an integer...

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In 4-byte pixel modes such as RGBA, this becomes a controlled backward heap underwrite: for a source image of width W, Pillow writes 4 W...

GHSA-6R8X-57C9-28J4 Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In 4-byte pixel modes such as RGBA, this becomes a controlled backward heap underwrite: for a source image of width W, Pillow writes 4 W...

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Summary Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size. Minimal public API trigger: python from PIL import Image, ImageFilter im = Image.new"L", 3, 3, 128 im.filterImageFilter.MedianFilter4294967295 ImageFilter.RankFilter.filt...