CVE-2026-68108

The CVE-2026-68108 entry covers the Linux kernel component drm/amdgpu/vce. The issue arises when malicious VCE command streams specify oversized dimensions (for example 65536×65536), triggering a 32-bit integer overflow that wraps the calculated buffer size to 0 and bypasses validation, enabling ...

EUVD-2026-55489

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

CVE-2026-68098

CVE-2026-68098 — ksmbd DACL dedup walk over copied ACEs (Linux kernel) : The issue arises in set_ntacl_dacl() when size accounting overflows and stops copying ACEs; nt_num_aces then represents only copied ACEs while the dedup walk in set_posix_acl_entries_dacl() continues using the (outdated) inp...

Astra Linux – Vulnerability in glibc

Passing an excessively large alignment parameter to the memalign functions memalign, posixmemalign, alignedalloc in the GNU C Library versions 2.30 to 2.42 may lead to an integer overflow, which could subsequently cause heap corruption. It should be noted that the attacker must have control over...

CVE-2026-43627

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...

CVE-2026-51259

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-51259

...

CVE-2026-66757

The CVE-2026-66757 issue affects the GIMP file-sgi plugin. Processing an RLE SGI image can trigger a signed integer overflow when reading header dimensions (ysize and zsize). If both are set to 65535, ysize * zsize overflows a 32-bit int prior to calloc, causing undefined behavior that aborts the...

CVE-2026-17573

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize

A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure ...

Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize

A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure ...

Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize

A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure ...

Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize

A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure ...

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Summary Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size. Minimal public API trigger: python from PIL import Image, ImageFilter im = Image.new"L", 3, 3, 128 im.filterImageFilter.MedianFilter4294967295 ImageFilter.RankFilter.filt...

CVE-2026-63886 scsi: target: iscsi: Validate CHAP_R length before base64 decode

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

OESA-2026-3025 libnfs security update

Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions. Security Fixe...

CVE-2026-59884

pyasn1 prior to 0.6.4 contains a denial-of-service risk in its BER decoder used by CER/DER codecs: long-form tag IDs can be accumulated without an upper bound, enabling a crafted input to drive CPU usage quadratically and trigger unhandled ValueError paths in Python 3.11+ error formatting. Affect...

OPENSUSE-SU-2026:21336-1 Security update for openexr

This update for openexr fixes the following issues - CVE-2026-54920: unchecked integer overflows in Image::resize followed by an exception can lead to an invalid delete via uninitialized pointers bsc1269703. - CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a he...

PYSEC-2026-3237 TensorFlow vulnerable to integer overflow in math ops

Impact When RangeSize receives values that do not fit into an int64t, it crashes. cpp auto size = std::isintegral::value ? Eigen::numext::abslimit - start + Eigen::numext::absdelta - T1 / Eigen::numext::absdelta : Eigen::numext::ceil Eigen::numext::abslimit - start / delta; // This check does not...

CVE-2026-58472

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity...