CVE-2026-85363

A flaw was found in .NET. An integer overflow issue allows an unauthenticated remote attacker to achieve privilege escalation over the network. By convincing a user to process specially crafted input, an attacker can cause a calculation error that leads to unauthorized access with elevated...

CVE-2026-62438

A flaw in GIMP allows an attacker to cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by tricking a user into opening or previewing a specially crafted Bohemia Interactive (PAA) texture file . The root cause is an integer overflow during image dimension calculatio...

CVE-2026-62438 Gimp: gimp: paa integer overflow out-of-bounds read

A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...

CVE-2026-62438

A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...

CVE-2026-62439 Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

CVE-2026-62439

A flaw in GIMP 's file-pvr plug-in allows an integer overflow when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow , potentially leading to arbitrary c...

CVE-2026-62439

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

CVE-2026-62439 Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

Summary IPCameraFrameGrabber parses the Content-Length value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response these streams ar...

CVE-2026-102834

Prior to version 1.5.14 , JavaCV is vulnerable to an integer overflow in the IPCameraFrameGrabber component. The software doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length . An attacker can exploit this by providing an oversized Content-Length he...

CVE-2026-102834 JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint...

EUVD-2026-103157

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint...

CVE-2025-66969

Integer overflow in OpenModSim =1.11.0, leading to denial of service...

CVE-2026-109938

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can trigger a Denial of Service DoS by sending crafted mapped video geometry updates to a connecting client with video redirection enabled. Due to an integer overflow during coordinate calculations, the...

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and...

CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on...

CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on...

CVE-2026-102692

The RIOT microcontroller operating system contains an integer overflow vulnerability in the nanocoap component prior to version 2026.07 . Specifically, the software fails to enforce a 20-bit maximum block number when handling CoAP Block2 option values. This allows oversized values to pass from co...

DEBIAN-CVE-2026-57488

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...