CVE-2026-101968 Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled

An Integer Underflow Wrap or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed...

CVE-2026-101968

An Integer Underflow (Wrap or Wraparound) vulnerability exists in the rpd process of Juniper Networks Junos OS (EX Series and MX Series) and Junos OS Evolved (ACX Series). When Rosen-MVPN data-MDT is enabled, an unauthenticated adjacent attacker can exploit this flaw using a malformed Rosen-MVPN ...

EUVD-2026-101325

An Integer Underflow Wrap or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed...

CVE-2026-101938 Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used

An Integer Underflow Wrap or Wraparound vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session...

CVE-2026-101938

Juniper Networks Junos OS and Junos OS Evolved on the SRX Series are affected by an Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe component. This flaw occurs when SVR vector routing is utilized, allowing an adjacent unauthenticated attacker to trigger an ICMP message associat...

EUVD-2026-101490

An Integer Underflow Wrap or Wraparound vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session...

CVE-2026-101938 Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used

An Integer Underflow Wrap or Wraparound vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session...

EUVD-2026-101439

An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash...

CVE-2026-101980 Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled

An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash...

DEBIAN-CVE-2026-110714

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

CVE-2026-110714

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

CVE-2026-110714

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

Game Music Emulators developers’ game-music-emu buffer error vulnerability

Developers of Game Music Emulators like game-music-emu 0.6.5 and earlier have a buffer error vulnerability. This vulnerability stems from integer underflow during the boundary check on the track-table in the AY loader’s getdata function. As a result, heap out-of-bounds reading occurs. Attackers c...

DEBIAN-CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110714 libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

EUVD-2026-101137

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

CVE-2026-110714

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

CVE-2026-110714 libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...