CVE-2026-112052

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112052 libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112052

Versions of libspatialite through 5.1.0 are vulnerable to an integer overflow within the WKB point and vertex count size guard of the ParseWkbLine and related parsers in gg_wkb.c . An attacker can provide a specially crafted geometry BLOB—such as one within a SpatiaLite database file —containing ...

EUVD-2026-103514

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112052 libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112011

libtta through 2.3 contains an integer overflow vulnerability in ttadecoderinitgetinfo that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek...

CVE-2026-112011

The libtta library (through version 2.3 ) is vulnerable to an integer overflow within the tta_decoder_init_get_info() function. This flaw occurs when the application processes unvalidated header fields from a crafted .tta file . Specifically, by providing a sample rate of 1 and a large samples va...

EUVD-2026-103464

libtta through 2.3 contains an integer overflow vulnerability in ttadecoderinitgetinfo that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek...

CVE-2026-112011 libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table

libtta through 2.3 contains an integer overflow vulnerability in ttadecoderinitgetinfo that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek...

Linux Distros Unpatched Vulnerability : CVE-2026-98634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzon...

CVE-2026-98634: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

CVE-2026-112011: Integer Overflow or Wraparound

libtta through 2.3 contains an integer overflow vulnerability in ttadecoderinitgetinfo that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek...

CVE-2026-98731: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...

PT-2026-117038

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8 MAX, and records exceeding...

PT-2026-116635

Name of the Vulnerable Software and Affected Versions libspatialite versions prior to 5.1.1 Description An integer overflow exists in the WKB point and vertex count size guard within the ParseWkbLine function and related parsers in gg wkb.c. This flaw allows out-of-bounds reads when processing a...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2024:1722977984)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2024:1722977984 advisory. - In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure on...

PT-2026-117048

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extra len overflow In ieee80211 rx h defragment, fragment payloads are accumulated into entry-extra len as subsequent fragments arrive: entry-extra len += rx-skb-len; When the fin...

Linux Distros Unpatched Vulnerability : CVE-2026-98819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory...

CVE-2026-98547: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

PT-2026-116766

In the Linux kernel, the following vulnerability has been resolved: af packet: fix integer overflow in prb calc retire blk tmo prb calc retire blk tmo computes in 32-bit int arithmetic: mbits = blk size in bytes 8 / 1024 1024; If I'm reading the validation right, tp block size is user controlled...