CVE-2025-0690

CVE-2025-0690: GRUB2 整数溢出漏洞 🛡️ 概述 CVE-2025-0690 是引导加载程序 GRUB2 中的一个 整数溢出 关键漏洞，允许 任意代码执行 和 绕过 Secure Boot 。该缺陷影响依赖 GRUB2 进行安全启动的系统，在操作系统启动前暴露系统。 🔍 技术细节 根本原因 易受攻击的命令 ：read（用于接收键盘输入）。 问题 ：输入长度存储在一个 32 位整数 中。 利用机制 ： 输入极长的文本行。 导致长度变量 溢出 。 进而导致基于 堆 的缓冲区发生 越界写入（out-of-bounds write） 。 后果 破坏 GRUB2 内部关键数据 。...

poppler: poppler: Data corruption via integer overflow in FoFiTrueType::cvtSfnts

A flaw was found in Poppler. An integer overflow vulnerability in the TrueType font handling code can allow a local user to cause data corruption. By providing a specially crafted font file processed by the FoFiTrueType::cvtSfnts function, an attacker can cause improper data modification and...

poppler: poppler: Denial of Service via integer overflow in SplashClip

A flaw was found in poppler. An integer overflow vulnerability exists in the SplashClip rendering component when handling path clipping operations. A local attacker could exploit this flaw by providing specially crafted input, causing the application to crash and resulting in a Denial of Service...

PoC-CVE-2022-26809

PoC-CVE-2022-26809 用于 CVE-2022-26809 的 PoC，分析和注意事项见 github.io。 该 PoC 是通过重写 Impacket 函数编写的。 测试环境：impacket 版本 0.10.0 该 PoC 尚未被完全测试，因为它应该触发该漏洞， 即整数溢出，导致堆上的缓冲区溢出，需要在发送 1048576 个数据包后才会触发，因为 10485764096 溢出了 32 位整数。 我没有找到任何绕过大小限制的方法，在我看来，16 位的分片长度会与真实负载大小进行核对，两者必须保持一致。 局限性： 1. 内存 -...

BIT-PHP-MIN-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-PHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-PHP-MIN-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

BIT-PHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

BIT-PGBOUNCER-2026-6668 Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

BIT-LIBPHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-LIBPHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CLEANSTART-2024-QV79984 WebPImage::decodeChunks integer overflow in Exiv2 through 0

Security vulnerability affects the exiv2 package. A WebPImage::decodeChunks integer overflow in Exiv2 through 0...

RLSA-2026:74084 Critical: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2023-4860 chromium-browser: angle: Out of bounds memory access in ANGLE CVE-2024-7532 chromium-browser:...

webkit2gtk3 security update

An update is available for webkit2gtk3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list WebKitGTK is the port of the portable web rendering engine WebKit to the...

CVE-2025-3500-Poc

Lab: CVE-2025-3500 - Avast Antivirus 整数溢出权限提升漏洞 下载 下载实验 ZIP：https://github.com/chicken3962/CVE-2025-3500-Poc/releases/download/Release/cve-2025-3500.zip 🚀 概述 本仓库提供了一个用于研究 CVE-2025-3500 的实验环境，该漏洞是 Windows 平台上 Avast Antivirus 25.1.981.6...

CLEANSTART-2024-WK36293 Integer overflow vulnerability in pcre2test before 10

Security vulnerability affects the pcre2 package. Integer overflow vulnerability in pcre2test before 10...

CVE-2023-28753

CVE-2023-28753 一个可能导致堆内存破坏的整数溢出漏洞。 为了演示堆破坏： 使用 ASAN 构建 ncrx 服务器 make ./ncrx 31337 对抗性客户端 python exploit.py -g | nc -u 127.0.0.1 31337...

Chromium CVE-2026-87643: Integer overflow in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-59346-POC

CVE-2026-59346 — Desbordamiento de entero en TSO de VMXNET3 VMware Workstation / Fusion Prueba de concepto de un desbordamiento de entero de 32 bits en la ruta de segmentación TSO de la NIC virtual VMXNET3 en vmware-vmx, alcanzable desde una VM invitada. Este problema está parcheado. La PoC se...

SUSE CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...