CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010

The smpeg library (versions through 2.0.0 ) is vulnerable to an integer underflow in the stream_header() function within MPEGsystem.cpp. An attacker can supply a crafted MPEG file via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data to wrap the packet_size by declaring an undersized packet length. T...

CVE-2026-112010 smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010 smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

PT-2026-116614

smpeg through 2.0.0 contains an integer underflow vulnerability in stream header in MPEGsystem.cpp that allows attackers to wrap packet size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG new, SMPEG new rwops or SMPEG new data to trigger a...

PT-2026-116810

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb pointer if linear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. Th...

CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881

The FreeRDP software versions 3.14.1 through 3.31.x are vulnerable to an integer underflow in the WinPR BMP writer . The issue occurs when a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero during the processing of sub-byte images. A malicious RDP clipboard peer can trigger this b...

CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881 FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

EUVD-2026-103337

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-81000

⚡ CVE-2026-81000 - TUNderflow Linux Kernel TUN/TAP Receive Headroom Memory Corruption A Linux kernel memory-corruption vulnerability in the TUN/TAP networking subsystem , caused by insufficient bounds on receive headroom and an integer underflow in the packet allocation path. ⚠️ Disclaimer This...

Linux Distros Unpatched Vulnerability : CVE-2026-110598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via...

Linux Distros Unpatched Vulnerability : CVE-2026-110714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-111881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero...

PT-2026-116453

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE MAX - 3 to Stream Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard synthesize image format to bm...

CVE-2026-111162

A flaw was found in WildMIDI. When parsing HMP audio files, an integer underflow in chunk length calculations causes the application to read beyond allocated memory boundaries. By tricking a user into opening a specially crafted file, an attacker can trigger an application crash, resulting in a...

CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...