88817 matches found
PT-2026-89764
Name of the Vulnerable Software and Affected Versions PCRE2 versions prior to 10.48 Description On 32-bit platforms, an integer overflow occurs within the pcre2 compile 32 function, which can lead to an out-of-bounds write. An integer overflow happens when an arithmetic operation attempts to crea...
PT-2026-90248
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where the pcl for each segment macro incorrectly calculates the upper bound when a parsed chunk list contains a chunk with a ch segcount of zero...
PT-2026-90137
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the IPMB Intelligent Platform Management Bus component where the ipmb write function reads message fields before validating the length byte. This can lead to the reading o...
CVE-2026-89665: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...
CVE-2026-81000: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...
PT-2026-90381
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFSv2 sattr decoder within the svcxdr decode sattr function. When processing SETATTR or CREATE requests, the decoder converts microseconds to nanoseconds. On ILP32...
PT-2026-90257
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss unwrap resp priv function improperly validates the RPCSEC GSS opaque length. Because the sum of offset and opaque len is computed...
CVE-2026-89541: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...
PT-2026-96441
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdr decode sattr: iap-ia atime.tv nsec = tmp2 NSEC PER USEC; tmp2 is a u32 and NSEC PER USEC is...
PT-2026-96611
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...
CVE-2026-18495: Heap-based Buffer Overflow
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...
PT-2026-89997
Name of the Vulnerable Software and Affected Versions libtiff affected versions not specified Description A heap-buffer overflow occurs in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file that...
PT-2026-96389
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in nd label validate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. nd label validate bounds it against the config area size, but sizeof namespa...
CVE-2026-89606: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfsparsetag70packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed...
PT-2026-89741
Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description A flaw in the gst-plugins-good isomp4 plugin occurs when processing specially crafted MP4 or MOV files containing CEA-608 closed-caption data. An integer overflow in 32-bit unsigned...
CVE-2026-88914: Integer Overflow or Wraparound
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...
PT-2026-90284
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the kho preserved memory reserve function where the size of a preservation is calculated using a 32-bit integer shift operation 1 order + PAGE SHIFT. Because the...
CVE-2026-54240: Integer Overflow or Wraparound
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially...
CVE-2026-89157: Integer Overflow or Wraparound
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...