CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

EUVD-2026-85311

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

Important: Red Hat Security Advisory: postgresql:15 security update

An update for the postgresql:15 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

Security update for gimp

This update for gimp fixes the following issues: Security issues fixed: CVE-2026-59088: denial of service via signed integer overflow in FLI file processing bsc1274837. CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow bsc1274840. CVE-2026-66757: signed integer...

SUSE-SU-2026:4309-1 Security update for gimp

This update for gimp fixes the following issues: Security issues fixed: - CVE-2026-59088: denial of service via signed integer overflow in FLI file processing bsc1274837. - CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow bsc1274840. - CVE-2026-66757: signed intege...

CVE-2026-83601

A flaw was found in Netdata. An authenticated child agent can send an oversized DIMENSION SLOT value. This oversized value can lead to an integer overflow during memory allocation, causing a subsequent write operation to go beyond the allocated buffer. This out-of-bounds write can crash the paren...

OPENSUSE-SU-2026:21935-1 Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issue: - CVE-2025-55154: integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of- bounds write bsc1248078...

github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

php: PHP: Archive entry injection via integer overflow in TAR parser

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

CVE-2026-84449

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. An integer overflow can occur when processing extremely large RGB images, specifically during the calculation of image-plane strides. This overflow leads to an invalid memory access during the RGB-to-YCbCr color...

CVE-2026-84451

A flaw was found in libheif. A remote attacker could exploit an integer overflow vulnerability when processing a crafted uncompressed image tile. This overflow leads to an out-of-bounds read, which can cause tile-processing applications to crash, resulting in a denial of service. Mitigation...

CVE-2026-84450

A flaw was found in libheif. A remote attacker could provide a specially crafted image file that, when processed by the libheif library, can lead to an integer overflow during crop calculations. This issue can cause assert-enabled builds to abort, resulting in a denial of service DoS. In release...

CVE-2026-81878

A flaw was found in radare2, a UNIX-like reverse engineering framework. The CPython bytecode .pyc marshal parser is vulnerable to an integer overflow. By opening or inspecting a specially crafted .pyc file, an attacker can trigger a heap out-of-bounds write. This can lead to heap memory corruptio...

pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth

A flaw was found in PgBouncer. An unauthenticated remote attacker can exploit an integer overflow in the packet buffer growth logic by providing sufficiently large input. This causes the buffer size computation to overflow, leading to an infinite loop. As a result, a CPU core is saturated, and al...