3736 matches found
CVE-2026-34588 OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and...
CVE-2026-34380 OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undopxr24impl in src/lib/OpenEXRCore/internalpxr24.c at line 377. The...
CVE-2026-34380
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undopxr24impl in src/lib/OpenEXRCore/internalpxr24.c at line 377. The...
CVE-2026-34380
OpenEXRFix: CVE-2026-34380 describes a signed integer overflow in undo_pxr24_impl() in OpenEXRCore (src/lib/OpenEXRCore/internal_pxr24.c) that could cause the decoding loop to write beyond the allocated output buffer. Affected versions are 3.2.0 up to but not including 3.2.7, 3.3.9, and 3.4.9. Th...
CVE-2026-34380 OpenEXR has a signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undopxr24impl in src/lib/OpenEXRCore/internalpxr24.c at line 377. The...
CVE-2026-34378
OpenEXR vulnerability overview: The EXR file format library OpenEXR is affected in versions 3.4.0 through before 3.4.9 due to a missing bounds check on the dataWindow attribute in headers, which can trigger a signed integer overflow in generic_unpack() when dataWindow.min.x is set to a large nega...
CVE-2026-34378
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overfl...
CVE-2026-34378 OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overfl...
EUVD-2026-19303
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overfl...
PT-2026-30727
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain checkChain: false. Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This...
discount 缓冲区错误漏洞
Discount is a Markdown language parsing and conversion tool developed by Orc developers. Versions of Discount from 1.3.1.1 to 2.2.7.4 contained a buffer error vulnerability. This vulnerability stemmed from a signed length truncation error, which could lead to out-of-bounds reads and process crash...
PT-2026-30724
Name of the Vulnerable Software and Affected Versions Discount versions 1.3.1.1 through 2.2.7.3 Description A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT MAX are truncated to a signed int before entering the native parser,...
PT-2026-30657
Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.8 Description A missing bounds check on the dataWindow attribute in EXR file headers can lead to a signed integer overflow in the generic unpack function. Setting dataWindow.min.x to a large negative value...
rdiscount has an Out-of-bounds Read
Summary A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INTMAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. Details In both...
GHSA-H762-RHV3-H25V OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
Summary The B44/B44A decoder in OpenEXR reconstructs row pointers into a scratch buffer using int. When the channel width nx is large enough, the product y nx overflows int, causing the row pointer to wrap before the start of the scratch buffer. Subsequent memcpy calls then write decoded pixel...
CVE-2026-29141
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as signed OK...
EUVD-2026-18533
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation App/FeatureSet/Identity/Utils/SSO.ts has decoupled signature verification and identity extraction. isSignatureValid verifies the first element in the XML DOM using...
EUVD-2026-18162
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as signed OK...
