kernel: sctp: prevent peer transport count overflow

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. An integer overflow occurs when the transportcount for an association exceeds its 16-bit limit, causing it to wrap around to zero. This allows a diagnostic dump to write 8 MiB of peer address...

SUSE CVE-2026-93311

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed...

SUSE CVE-2026-93313

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could ...

SUSE CVE-2026-93314

A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly...

SUSE CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

SUSE CVE-2026-96674

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

CVE-2026-88361

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec when parsing PDF PageLabels /Nums entries...

CVE-2026-88365

minimp3 commit ea99364f contains an integer overflow vulnerability in mp3decskipid3v1 when parsing the APEv2 tag-size field...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 13 Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is...

EUVD-2026-86064

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

CVE-2026-97451

The Linux kernel contains an integer overflow vulnerability in the ACPICA component, specifically within the acpi_ex_opcode_3A_1T_1R() (mid_op) function. The root cause is a missing overflow check when calculating the truncation length for Index + Length . This flaw can result in a negative size ...

CVE-2026-97451 ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

CVE-2026-97451 ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

EUVD-2026-86034

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ibumemfindbestpgsz Several corner cases, especially important on 32 bits: - umem-iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the...

CVE-2026-97421

The Linux kernel contains a vulnerability in the RDMA/umem subsystem related to boundary conditions in the ib_umem_find_best_pgsz() function. The issue specifically affects 32-bit systems due to several corner cases: the umem->iova is a u64 and requires a u64 argument to prevent truncation, a ...

CVE-2026-97421 RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ibumemfindbestpgsz Several corner cases, especially important on 32 bits: - umem-iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the...

CVE-2026-97421 RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ibumemfindbestpgsz Several corner cases, especially important on 32 bits: - umem-iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the...

EUVD-2026-86217

In the Linux kernel, the following vulnerability has been resolved: exfat: fix handling of damaged volume in exfatcreateupcasetable When the size of the upcase table is set to zero in the dentry for any reasone.g. corrupted media or misbehaving device, an integer overflow causes the module to loo...

CVE-2026-93828 exfat: fix handling of damaged volume in exfat_create_upcase_table()

In the Linux kernel, the following vulnerability has been resolved: exfat: fix handling of damaged volume in exfatcreateupcasetable When the size of the upcase table is set to zero in the dentry for any reasone.g. corrupted media or misbehaving device, an integer overflow causes the module to loo...

CVE-2026-93828

A vulnerability exists in the Linux kernel 's exfat filesystem module. Specifically, the function exfat_create_upcase_table() can enter an infinite loop due to an integer overflow when the size of the upcase table is set to zero (e.g., due to corrupted media or a misbehaving device). The issue is...