EUVD-2026-103561

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

CVE-2026-98647

The Linux kernel contains a divide-by-zero vulnerability in the btf_struct_walk() function. The issue occurs when a BPF program access goes past a structure where the last member is a flexible array ; the function fails to verify that the element type has a non-zero size before performing a modul...

CVE-2026-98647 bpf: Fix divide-by-zero in btf_struct_walk()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

CVE-2026-98647

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

CVE-2026-98647 bpf: Fix divide-by-zero in btf_struct_walk()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

CVE-2026-98585

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

CVE-2026-98485

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

paracosme

Paracosme - CVE-2022-33318 - Remote Code Execution in ICONICS Genesis64 Paracosme is a memory corruption exploit I wrote to target the Genesis64 suite v10.97.1 made by ICONICS to achieve remote code execution. The exploit was demonstrated during the Pwn2Own 2022 Miami contest that took place at t...

CVE-2026-112054

Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slicebytesdenom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schrodecoderparsetransformparameters an...

Citrix_Secure_Access_LPE_0DAY

Citric Secure Access Local privilege escalation I have discovered a local privilege escalation vulnerability in the Citrix Secure Access Windows Client. This vulnerability allows a privileged administrator to inject a malicious payload to gain NT Authority privileges. The affected versions of...

CVE-2026-112054 Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing

Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slicebytesdenom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schrodecoderparsetransformparameters an...

CVE-2026-112054

Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slicebytesdenom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schrodecoderparsetransformparameters an...

CVE-2026-112054

The libschroedinger library (through version 1.0.11 ) is vulnerable to a divide by zero error during low-delay transform parsing . An attacker can cause a denial of service (DoS) by supplying a crafted low-delay picture within a Dirac stream that contains a zero slice_bytes_denom or a zero slice ...

CVE-2026-112054 Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing

Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slicebytesdenom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schrodecoderparsetransformparameters an...

EUVD-2026-103516

Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slicebytesdenom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schrodecoderparsetransformparameters an...

CVE-2026-112013

libtta through 2.3 contains a divide-by-zero vulnerability in ttadecoderinitgetinfo that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the...

EUVD-2026-103466

libtta through 2.3 contains a divide-by-zero vulnerability in ttadecoderinitgetinfo that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the...

CVE-2026-112013

The libtta library (through version 2.3 ) contains a divide-by-zero vulnerability within the tta_decoder_init_get_info() function. An attacker can cause an application to crash by providing a .tta file with an unvalidated zero sample rate and a recomputed header CRC32 . This trigger causes a SIGF...

CVE-2026-112013 libtta through 2.3 Divide by Zero via tta_decoder_init_get_info

libtta through 2.3 contains a divide-by-zero vulnerability in ttadecoderinitgetinfo that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the...

chub-supply-chain-poc

Context Hub Supply Chain PoC Zero-sanitization vulnerability inContext Hub @aisuite/chub v0.1.3 enables silent dependency injection through the MCP documentation pipeline. References: CWE-94 Code Injection | CWE-829 Untrusted Control Sphere | CWE-345 Insufficient Verification of Data Authenticity...