Linux Kernel Security Vulnerabilities

The Linux kernel version 3.2 has a security vulnerability. This vulnerability arises from the fact that the mac80211 proxy path is not reserved in the interface path counter. When the proxy path is removed or expires, the unreserved slots are returned, causing the counter to become negative. This...

Ryan C. Gordon smpeg – Numerical error vulnerability

Ryan C. Gordon’s MPEG2.0.0 and earlier versions have a numerical error vulnerability. This vulnerability stems from an integer underflow in the streamheader function of MPEGsystem.cpp, which allows packetsize to wrap around by declaring a packet length that is too small. Attackers can provide...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.13 contains security vulnerabilities. This vulnerability stems from the lack of ensuring that max is at least equal to skbheadlenskb. When parsing IPv6 extension headers, unsigned subtraction causes underflow and converts to a negative value, resulting in skbcopybits...

PT-2026-116453

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE MAX - 3 to Stream Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard synthesize image format to bm...

CVE-2026-111881: Integer Underflow (Wrap or Wraparound)

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

Linux Distros Unpatched Vulnerability : CVE-2026-110714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-111881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero...

Linux Distros Unpatched Vulnerability : CVE-2026-110598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via...

FreeBSD : miniupnpd -- Integer underflow in SOAPAction header parsing (43dc274d-f74b-4420-8ef8-d2e108213002)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 43dc274d-f74b-4420-8ef8-d2e108213002 advisory. An integer underflow in the SOAPAction header parsing in ParseHttpHeaders lets a remote attacker trigge...

CVE-2026-111162

A flaw was found in WildMIDI. When parsing HMP audio files, an integer underflow in chunk length calculations causes the application to read beyond allocated memory boundaries. By tricking a user into opening a specially crafted file, an attacker can trigger an application crash, resulting in a...

SUSE CVE-2026-111133

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

FreeRDP has a numerical error vulnerability

FreeRDP versions from 3.14.1 to 3.32.0 contain a numerical error vulnerability. This vulnerability stems from an integer underflow in the WinPR BMP writer. When the step size calculation does not match, the value SIZEMAX - 3 is passed to the StreamZero processing for sub-byte image handling...

CVE-2026-111152

A flaw was found in game-music-emu. This flaw allows an attacker to cause a Denial of Service DoS by crashing applications that process untrusted audio files. By providing a specially crafted ZXAYEMUL file with an oversized track table, an integer underflow in the AY loader triggers an...

OESA-2026-4395 popt security update

The popt library exists essentially for parsing command line options. Some specific advantages of popt are no global variables allowing multiple passes in parsing argv, parsing an arbitrary array of argv-style elements allowing parsing of command-line-strings from any source, a standard method of...

OESA-2026-4394 popt security update

The popt library exists essentially for parsing command line options. Some specific advantages of popt are no global variables allowing multiple passes in parsing argv, parsing an arbitrary array of argv-style elements allowing parsing of command-line-strings from any source, a standard method of...

OESA-2026-4393 popt security update

The popt library exists essentially for parsing command line options. Some specific advantages of popt are no global variables allowing multiple passes in parsing argv, parsing an arbitrary array of argv-style elements allowing parsing of command-line-strings from any source, a standard method of...

OESA-2026-4392 popt security update

The popt library exists essentially for parsing command line options. Some specific advantages of popt are no global variables allowing multiple passes in parsing argv, parsing an arbitrary array of argv-style elements allowing parsing of command-line-strings from any source, a standard method of...

OESA-2026-4375 jpegxl security update

This package contains a reference implementation of JPEG XL encoder and decoder. Security Fixes: libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet o...

CVE-2026-98403

A flaw was found in the Linux kernel's s390 boot code. This flaw can lead to a Denial of Service DoS through memory corruption during system startup. When the early boot command-line buffer is nearly full, appending Initial Program Load IPL parameters triggers an integer underflow, causing an...

UBUNTU-CVE-2026-111133

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...