7956 matches found
PT-2026-86452
Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description An unauthenticated client can initiate an IPv4 UDP test by exploiting a state where the system accepts a related btest connectio...
PT-2026-84837
Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.12 Description An integer underflow exists in the container box parser. On 32-bit platforms, 64-bit box sizes are truncated to size t, allowing remote attackers to provide a specially crafted JPEG XL file. This cause...
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...
SUSE CVE-2026-72382
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...
CLSA-2026-1788272453 gstreamer1-plugins-good: Fix of 6 CVEs
CVE-2026-18295: fix out-of-bounds write in MRF atoms recovery parsing that could lead to remote code execution - CVE-2026-18296: fix heap-based buffer overflow in MRF atoms recovery parsing that could lead to remote code execution - CVE-2026-18298: drop gdkpixbufdec rank to NONE and fix output...
SUSE CVE-2026-72326
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...
CVE-2026-80634
A flaw was found in the Linux kernel's netfilter flowtable component. An integer underflow can occur during bridge Virtual Local Area Network VLAN untagging operations. If the numencaps value is zero, a decrement operation can cause it to wrap to 255. This can lead to an out-of-bounds stack read...
CVE-2026-71401
A flaw was found in wicked, specifically in its DHCPv4 packet capture code. An integer underflow vulnerability exists where the nicaptureinspectudpheader function fails to validate the IP total length field against the IP header length before performing a subtraction. This oversight allows an...
CVE-2026-9624: Integer Underflow (Wrap or Wraparound)
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover...
CVE-2026-9622: Integer Underflow (Wrap or Wraparound)
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover...
SUSE CVE-2026-72195
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...
SUSE CVE-2026-72225
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...
USN-8707-1: openCryptoki vulnerabilities
It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. CVE-2026-40253 It was discovered that openCryptoki incorrectly handled symlinks. An attacker in the...
USN-8707-1 opencryptoki vulnerabilities
It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. CVE-2026-40253 It was discovered that openCryptoki incorrectly handled symlinks. An attacker in the...
FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling
A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol RDP packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the...
Important: iscsi-initiator-utils
Issue Overview: open-iscsi: open-iscsi: Stack buffer overflow in idbm record parsing CVE-2026-18724 open-iscsi: open-iscsi: Out-of-bounds access in iscsiuio ICMPv6 echo handling CVE-2026-18725 A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network...
Important: gimp
Issue Overview: A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed th...
Important: iscsi-initiator-utils
Issue Overview: open-iscsi: open-iscsi: Stack buffer overflow in idbm record parsing CVE-2026-18724 open-iscsi: open-iscsi: Out-of-bounds access in iscsiuio ICMPv6 echo handling CVE-2026-18725 A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network...