Astra Linux – Vulnerability in Qemu

QEMU prior to version 8.2.0 has an integer underflow issue, which can lead to a buffer overflow. This occurs due to a TI command, where a transfer length that is not a DMA transfer is processed, and the actual transfer length is shorter than the length of the available FIFO data. This issue arise...

Astra Linux – Vulnerability in Raptor2

In the Raptor RDF Syntax Library version 2.0.16, there is an integer underflow issue when normalizing a URI using the turtle parser in the raptorurinormalizepath function...

Astra Linux – Vulnerability in p7zip

Ppmd7.c in 7-ZIP before 23.00 allows for integer underflow and invalid read operations due to a crafted 7Z archive...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Regulator: Core – Prevent integer underflow By using a ratio of delay to pollEnabledTime that is not an integer, timeRemaining underflows may occur, causing the loop not to exit as expected. Since delay can be derived from DT, an...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfsparsetag70packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In the UpdateResidentValue case within doaction fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Ensure that mwifiexprocessmgmtpacket, mwifiexprocessstarxpacket and mwifiexprocessuaprxpacket, mwifiexuapqueuebridgedpkt and mwifiexprocessrxpacket do not access the...

Astra Linux – vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the extractccfromdata function within qtdemux.c. In the FOURCCc708 case, subtracting atomlength - 8 may result in an underflow if atomlength is less than 8. When this subtraction...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: jbd2: Fixed integer underflow in jbd2journalinitializefastcommit. jbd2journalinitializefastcommit validates the journal capacity by checking whether journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are...

Astra Linux – vulnerability in krb5

In MIT Kerberos 5 also known as krb5 versions prior to 1.22.3, an integer underflow leads to an out-of-bounds read when an application calls gssacceptseccontext on a system where a NegoEx mechanism is registered at /etc/gss/mech. An unauthenticated remote attacker can exploit this vulnerability,...

SUSE CVE-2026-88964

An integer underflow in OpenVPN version 2.7alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options...

CVE-2026-90274

A flaw was found in the Linux kernel's CoreSight ETM4 Embedded Trace Macrocell driver. A local user could cause a denial of service DoS by triggering an integer underflow during the initialization or configuration of trace sequence event registers. When trace sequence states are not implemented b...

PT-2026-115139

Name of the Vulnerable Software and Affected Versions libfsapfs versions prior to 20260922 Description An integer underflow exists in the libfsapfs key encrypted key read data function. This allows attackers to trigger heap out-of-bounds reads by providing a crafted encrypted APFS image with...

UBUNTU-CVE-2026-110714

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

UBUNTU-CVE-2026-88833

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causin...

CVE-2026-111133: Out-of-bounds Read

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

PT-2026-115158

Name of the Vulnerable Software and Affected Versions Game Music Emu libgme versions 0.6.5 and earlier Description A heap out-of-bounds read occurs in the AY loader get data function due to an integer underflow during the track-table bounds check. An attacker can use a specially crafted ZXAYEMUL...

UBUNTU-CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-101980

An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash...

CVE-2026-101968

An Integer Underflow Wrap or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed...