13541 matches found
CVE-2026-64573
The CVE-2026-64573 issue affects the Linux kernel Bluetooth stack (qca TLV parser). In the TLV_TYPE_NVM branch of qca_tlv_check_data(), the loop bound used length - sizeof(struct tlv_type_nvm) with length as a signed int promoted to size_t, which could underflow when firmware
CVE-2026-71202 raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic
The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...
EUVD-2026-53199
The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, width2 - offsetx or the height...
CVE-2026-71202
The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, width2 - offsetx or the height...
CVE-2026-71202
The CVE-2026-71202 entry concerns the raster Rust crate. The crop() implementation clamps width/height but only clamps offset_x/offset_y against 0, not against the source width/height. If an offset exceeds the source dimension, width2 - offset_x underflows to a negative i32, which is then cast to...
CVE-2026-71202 raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic
The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...
PT-2026-68040
Name of the Vulnerable Software and Affected Versions raster Rust crate affected versions not specified Description The crop function src/editor.rs fails to properly clamp the offset x and offset y parameters against the source width and height, only clamping them against 0. If an offset exceeds...
PT-2026-68074
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the TLV parser of the Bluetooth qca component. In the TLV TYPE NVM branch of the qca tlv check data function, the loop bound calculation uses a signed...
CVE-2026-64573: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...
PT-2026-68078
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The gtp1u send echo resp function fails to check the return value of skb pull data. When processing an echo request between 16 and 19 bytes, the pull request for 20 bytes fails and retur...
PT-2026-68081
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm6 fill dst function where the dst.dev is not cleared during an error path when in6 dev getdev returns NULL. In this scenario, the function releases the device...
CVE-2026-64580: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...
CVE-2026-71202: Integer Underflow (Wrap or Wraparound)
The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...
PT-2026-68332
Name of the Vulnerable Software and Affected Versions popt affected versions not specified Description An integer underflow occurs in the popt library when formatting help text for option tables that exceed the terminal width. A local user can trigger this by causing an application to print help...
CVE-2026-18839: Integer Underflow (Wrap or Wraparound)
An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of servi...
Linux Distros Unpatched Vulnerability : CVE-2026-18839
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an...
PT-2026-68354
Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1 Description A size t underflow occurs in the H5Z filter fletcher32 function within H5Zfletcher32.c. The issue arises when the software computes the data length to checksum by subtracting the 4-byte trailing checksu...
CVE-2026-37462
A flaw was found in gobgp. An integer underflow vulnerability in the BGPUpdate.DecodeFromBytes function allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted BGP Border Gateway Protocol UPDATE message. This can disrupt network operations and make the affected...