CVE-2026-64531

CVE-2026-64531 — OVSwrap Linux カーネル Open vSwitch モジュールのローカル権限昇格一般ユーザー → rootPoC。16 ビット nlalen フィールドの整数ラップアラウンドを利用し、一般ユーザー から root まで一気に昇格します。 脆弱性の概要 OVS が生成するネストされた action ストリームが 65535 バイトを超えると、16 ビットの nlalen フィールドがラップアラウンドします。攻撃者はプライベートユーザー/ネットワーク名前空間内で CAPNETADMIN を保持しているだけで、超長の CLONE action...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

Important: Red Hat Security Advisory: postgresql18 security update

An update for postgresql18 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

CVE-2026-90783

A flaw was found in MKVToolNix. An attacker can exploit this vulnerability by crafting a malicious AVI Audio Video Interleave file. When the mkvmerge tool processes this file, an integer wraparound in the bundled avilib library's ODML OpenDML superindex parser leads to an undersized memory...

UBUNTU-CVE-2026-89665

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

RHEL 10 : postgresql18 (RHSA-2026:67280)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67280 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that...

CVE-2026-90783

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer...

DEBIAN-CVE-2026-90783

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer...

CVE-2026-90783

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser , caused by integer wraparound in 32-bit arithmetic . An attacker can craft a malicious AVI file with oversized entry counts, triggering an undersized heap allocation that overflows whe...

EUVD-2026-77010

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer...

CVE-2026-90783 MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-90783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic...

PT-2026-90858

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-89665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr:...

CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

Updated perl-DBI packages fix security vulnerabilities

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in...

MGASA-2026-0390 Updated perl-DBI packages fix security vulnerabilities

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in...

CVE-2026-38427

CVE-2026-38427: Tasmota fetchjpg における整数ラップアラウンド → ヒープバッファオーバーフロー CVE: CVE-2026-38427 深刻度: 緊急 CVSS 9.8 製品: Arendst Tasmota 影響を受けるバージョン: = 15.3.0.3 ファイル: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino 関数: fetchjpg — ケース 2 MJPEGフレーム取得 著者: Saidakbarxon Maxsudxonov 開示: 責任ある開示 — 公開前にTasmotaへ報告済み 概要...