Monthly
libjpeg-turbo 3.2.0's PNG loader triggers an integer division-by-zero crash when tj3LoadImage12() or tj3LoadImage16() processes a valid indexed-color PNG image bearing a non-gray palette under the default pixel format. The fault occurs inside alloc_sarray(), generating a SIGFPE that terminates any application relying on those APIs to handle externally supplied images. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the crash is reproducible with a standards-compliant PNG file, making any network-facing image-ingestion service a realistic denial-of-service target.
Divide-by-zero in Aria2's BitTorrent helper module (src/bittorrent_helper.cc) crashes the download utility when processing malformed BitTorrent data, resulting in denial of service. Aria2 1.37.0 and all prior versions are affected. No public exploit code and no CISA KEV listing have been identified; EPSS places exploitation probability at the 4th percentile, indicating negligible real-world exploitation pressure at time of analysis.
Local denial-of-service in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a high-privileged local attacker to crash the system via an out-of-bounds write condition. The attack is constrained to local access with elevated privileges (PR:H per CVSS), limiting the practical blast radius primarily to insider threats or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency triage category despite the severity of the availability impact.
Server-side divide-by-zero in FreeRDP's rdpsnd audio channel allows any authenticated RDP client to crash the server-side audio process. By advertising a DVI ADPCM format with nBlockAlign=8 and nChannels=2, the client forces the `bs` block-size calculation to zero; the subsequent modulo operation raises SIGFPE and terminates the rdpsnd channel process. No public exploit or KEV listing exists; exploitation is constrained to authenticated sessions, but the low complexity makes it a credible denial-of-service risk in environments with audio redirection enabled.
Divide-by-zero in Velociraptor's ShouldPadFile() function allows a rogue enrolled client to crash the server process by uploading a malformed sparse file. When a GUI operator attempts to expand the file in the web interface, the unguarded division triggers a Go runtime panic, taking down the server. No public exploit code is identified at time of analysis, and CVSS rates this Low (3.5) with availability-only impact, but the attack is straightforward for any attacker who controls an enrolled endpoint.
HDF5 library through version 2.3.0 crashes with a divide-by-zero when a process opens a crafted file containing mismatched chunk-layout and dataspace dimensionality. The missing rank validation in H5O__layout_decode allows the corrupt metadata to propagate unchecked to H5S__hyper_iter_get_seq_list, where the invalid value causes integer division by zero and application termination. Tools that automatically consume externally-supplied HDF5 files - such as the bundled h5repack utility - are the primary exposure surface; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Divide-by-zero in FreeRDP's rdpecam camera redirection channel allows a malicious or compromised RDP server to crash the connecting client process by sending a StartStreamsRequest PDU with FrameRateDenominator set to zero. All FreeRDP releases up to and including 3.28.0 are affected when camera redirection is enabled; exploitation delivers a reliable client-side denial-of-service (SIGFPE termination) with no code execution potential. No public exploit or CISA KEV listing exists at time of analysis; this is a medium-severity availability issue patched in FreeRDP 3.29.0.
A divide-by-zero vulnerability in Xen's Viridian periodic STIMER handling allows an attacker with guest VM access to crash the hypervisor, causing denial of service. The issue arises from an unchecked user-controlled divisor that can be set to zero, triggering a #DE fault. No active exploitation is known per SSVC, though the attack is automatable and requires no guest-level privileges.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
libjpeg-turbo 3.2.0's PNG loader triggers an integer division-by-zero crash when tj3LoadImage12() or tj3LoadImage16() processes a valid indexed-color PNG image bearing a non-gray palette under the default pixel format. The fault occurs inside alloc_sarray(), generating a SIGFPE that terminates any application relying on those APIs to handle externally supplied images. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the crash is reproducible with a standards-compliant PNG file, making any network-facing image-ingestion service a realistic denial-of-service target.
Divide-by-zero in Aria2's BitTorrent helper module (src/bittorrent_helper.cc) crashes the download utility when processing malformed BitTorrent data, resulting in denial of service. Aria2 1.37.0 and all prior versions are affected. No public exploit code and no CISA KEV listing have been identified; EPSS places exploitation probability at the 4th percentile, indicating negligible real-world exploitation pressure at time of analysis.
Local denial-of-service in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a high-privileged local attacker to crash the system via an out-of-bounds write condition. The attack is constrained to local access with elevated privileges (PR:H per CVSS), limiting the practical blast radius primarily to insider threats or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency triage category despite the severity of the availability impact.
Server-side divide-by-zero in FreeRDP's rdpsnd audio channel allows any authenticated RDP client to crash the server-side audio process. By advertising a DVI ADPCM format with nBlockAlign=8 and nChannels=2, the client forces the `bs` block-size calculation to zero; the subsequent modulo operation raises SIGFPE and terminates the rdpsnd channel process. No public exploit or KEV listing exists; exploitation is constrained to authenticated sessions, but the low complexity makes it a credible denial-of-service risk in environments with audio redirection enabled.
Divide-by-zero in Velociraptor's ShouldPadFile() function allows a rogue enrolled client to crash the server process by uploading a malformed sparse file. When a GUI operator attempts to expand the file in the web interface, the unguarded division triggers a Go runtime panic, taking down the server. No public exploit code is identified at time of analysis, and CVSS rates this Low (3.5) with availability-only impact, but the attack is straightforward for any attacker who controls an enrolled endpoint.
HDF5 library through version 2.3.0 crashes with a divide-by-zero when a process opens a crafted file containing mismatched chunk-layout and dataspace dimensionality. The missing rank validation in H5O__layout_decode allows the corrupt metadata to propagate unchecked to H5S__hyper_iter_get_seq_list, where the invalid value causes integer division by zero and application termination. Tools that automatically consume externally-supplied HDF5 files - such as the bundled h5repack utility - are the primary exposure surface; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Divide-by-zero in FreeRDP's rdpecam camera redirection channel allows a malicious or compromised RDP server to crash the connecting client process by sending a StartStreamsRequest PDU with FrameRateDenominator set to zero. All FreeRDP releases up to and including 3.28.0 are affected when camera redirection is enabled; exploitation delivers a reliable client-side denial-of-service (SIGFPE termination) with no code execution potential. No public exploit or CISA KEV listing exists at time of analysis; this is a medium-severity availability issue patched in FreeRDP 3.29.0.
A divide-by-zero vulnerability in Xen's Viridian periodic STIMER handling allows an attacker with guest VM access to crash the hypervisor, causing denial of service. The issue arises from an unchecked user-controlled divisor that can be set to zero, triggering a #DE fault. No active exploitation is known per SSVC, though the attack is automatable and requires no guest-level privileges.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.