Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In 4-byte pixel modes such as RGBA, this becomes a controlled backward heap underwrite: for a source image of width W, Pillow writes 4 W...

GHSA-6R8X-57C9-28J4 Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In 4-byte pixel modes such as RGBA, this becomes a controlled backward heap underwrite: for a source image of width W, Pillow writes 4 W...

CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

UBUNTU-CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

CVE-2026-63091 ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

CVE-2026-63091

ProFTPD mod_sftp in versions before 1.3.9c and 1.3.10rc3 contains a signed integer overflow in the SCP size-record parser. An authenticated, low-privilege attacker can send a crafted file size (UINT64_MAX) to produce a negative off_t, convert to uint32_t, and trigger ~4 GB read length, causing th...

CVE-2026-63091: Integer Overflow or Wraparound

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

K000162312: Linux kernel vulnerability CVE-2022-50865

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcpaddbacklog The type of skrcvbuf and sksndbuf in struct sock is int, and in tcpaddbacklog, the variable limit is caculated by adding skrcvbuf, sksndbuf and...

Alibaba Cloud Linux 3 : 0205: gstreamer1-plugins-bad-free (ALINUX3-SA-2026:0205)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0205 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-52718: A denial of service...

EUVD-2026-43602

In OpENer 2.3.0 commit 76b95cf when parsing incoming CIP Common Industrial Protocol network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 a 16-bit signe...

EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2026-2702)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile...

AZL-92415 CVE-2026-57433 affecting package perl for versions less than 5.38.2-514

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negative value. A...

UBUNTU-CVE-2026-57433

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negative value. A...

EUVD-2026-43501

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negative value. A...

CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negative value. A...

CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negative value. A...

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Summaryinternalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic:cwavbuf += nx ny wcount;Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path...

PT-2026-57824

Name of the Vulnerable Software and Affected Versions Storable versions prior to 3.41 Description A signed integer overflow occurs during the deserialization of a specially crafted SX HOOK record. The function retrieve hook common reads a signed 32-bit item count and passes it to av extend after...

RLSA-2026:36834 Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tilelistobu parser byte/bit...

gstreamer1-plugins-bad-free security update

An update is available for gstreamer1-plugins-bad-free. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs ...