57448 matches found
EUVD-2026-62660
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
CVE-2026-72369
A flaw was found in the Linux kernel's Minix filesystem. A local attacker can exploit this vulnerability by mounting a specially crafted Minix v3 image. This image can contain specific inode or zone counts that trigger an integer overflow during the calculation of bitmap block counts. The overflo...
CVE-2026-74569
A flaw was found in the Linux kernel's netfilter Session Initiation Protocol SIP connection tracking module nfconntracksip. A remote attacker could send specially crafted SIP messages that cause an integer overflow during Network Address Translation NAT rewrite delta calculations. This overflow...
MINI-WR2R-V8PH-C7QX
Bulletin has no description...
CVE-2026-70628
A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV Windows Recorded TV Show file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence ...
MINI-M3MV-CJRM-PJPF
Bulletin has no description...
MINI-V553-4X5C-3F29
Bulletin has no description...
EUVD-2026-62584
FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpencav1.c. The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first...
CVE-2026-75145
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...
CVE-2026-75145
FFmpeg before commit b4c199c contains an integer narrowing conversion flaw in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before being compared against the remaining frame size. On platforms where long is 32 bits (including 64-bit Windows ), sufficiently large ...
CVE-2026-75141
FFmpeg versions before commit acf5d7c have a heap buffer overflow in the hvcC box writer. A crafted HEVC file triggers NAL unit count overflow during muxing, leading to memory corruption; CVSS 3.1 scores it HIGH (7.8). No exploitation is confirmed. Upgrade to a version containing the fix commit. ...
CVE-2026-52834
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834
The Rust crate jxl-grid (versions 0.1.1–0.5.3) computes width * height unchecked in AlignedGrid::with_alloc_tracker, which overflows usize on 32-bit targets, allocating undersized backing buffers. A crafted JPEG XL image decoded via render_frame() triggers out-of-bounds writes through mutable sub...
EUVD-2026-62513
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-75148
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltfvalidate that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input...
DEBIAN-CVE-2026-65610
nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression homelen - 1 is promoted to signed int and becomes -1 an...