JLSEC-2025-51 Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function...

JLSEC-2025-45 `build_model` in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

buildmodel in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-63 An issue was discovered in libexpat before 2.6.3

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms where UINTMAX equals SIZEMAX...

JLSEC-2025-47 lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

lookup in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-43 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for...

In doProlog in xmlparse.c in Expat aka libexpat before 2.4.3, an integer overflow exists for mgroupSize...

JLSEC-2025-49 storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

storeAtts in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-50 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in `XML_GetBuffer`, for...

Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES...

JLSEC-2025-56 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

In Expat aka libexpat before 2.4.5, there is an integer overflow in storeRawNames...

JLSEC-2025-64 An issue was discovered in libexpat before 2.6.3

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for mgroupSize on 32-bit platforms where UINTMAX equals SIZEMAX...

JLSEC-2025-44 addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

addBinding in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-55 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

In Expat aka libexpat before 2.4.5, there is an integer overflow in copyString...

MITRE CVE-2025-54957: Integer overflow in Dolby Digital Plus audio decoder

Deserialization of untrusted data in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally...

Windows Speech Runtime Elevation of Privilege Vulnerability

Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally...

EUVD-2025-34176

In wlan AP driver, there is a possible out of bounds write due to an integer overflow. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418785; Issue ID: MSV-3515...

CVE-2025-20722

In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798...

CVE-2025-20722

In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798...

CVE-2025-20722

In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798...

CVE-2025-20722

In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798...

CVE-2025-20722

CVE-2025-20722 affects the gnss driver with an out-of-bounds read caused by an integer overflow. Exploitation would lead to local information disclosure if the attacker already has System privileges; no user interaction is required. A patch (ALPS09920036) is referenced (Issue MSV-3798).

CVE-2025-20710

In wlan AP driver, there is a possible out of bounds write due to an integer overflow. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418785; Issue ID: MSV-3515...