Monthly
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text fed to that interface to read process memory beyond the input buffer, cause silent acceptance of a truncated document fragment as complete, or terminate the host process. Affected systems are any C++ applications embedding the driver that parse externally-controlled JSON; MongoDB server connectivity, credentials, and non-default configuration are explicitly not required. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects both the constraint of requiring very large input documents and the local library-consumer trust boundary.
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cause applications to silently store truncated or dropped numeric fields. CWE-681 (incorrect conversion between numeric types) triggers when an oversized text-encoded numeric value is parsed: the driver returns a success result while the resulting BSON silently shortens or omits the field entirely. Applications depending on this library for accurate numeric representation - without independent input validation - may persist corrupt data without any indication of failure, creating exploitable logical inconsistencies. No public exploit code or active exploitation has been identified at time of analysis.
Process termination via out-of-bounds memory read affects the MongoDB C++ Driver's BSON document builder, caused by a numeric type conversion error (CWE-681) that misinterprets a field name length when an application supplies an extremely large, non-null-terminated field name in a specific form. All versions of the C++ Driver are indicated as in scope per the wildcard CPE. No public exploit code and no CISA KEV listing exist at time of analysis; MongoDB's own Jira (CXX-3548) is the sole public tracking reference, and no fixed release version has been disclosed in the available data.
Integer underflow in libjxl's container box parser before v0.12.0 allows unauthenticated remote attackers to inject arbitrary image metadata into JPEG XL files decoded on 32-bit platforms. The flaw arises from silent truncation of 64-bit ISOBMFF-style box sizes to the narrower size_t type, causing the decoder to misinterpret attacker-controlled codestream bytes as phantom box headers and insert forged Exif, XMP, IPTC, or JUMBF metadata blocks into its internal state. A secondary effect is potential out-of-bounds memory reads, though no active exploitation or public proof-of-concept code has been identified; a vendor patch is available in v0.12.0.
Privilege escalation in su-exec through version 0.3 allows local attackers with low-privilege access to execute arbitrary programs as root by supplying crafted oversized numeric user or group identifiers. The root cause is an unchecked integer truncation: strtol() returns a 64-bit long on modern Linux, but su-exec assigns the result directly to uid_t and gid_t (32-bit unsigned integers) without range validation - values like 4294967296 (2^32) silently truncate to UID/GID 0, the root account. A public proof-of-concept is available and no vendor-released patch has been identified at time of analysis, making this an active remediation gap for container deployments dependent on su-exec.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the `writeString()` method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds memory copy in QEMU's vhost inflight migration VMState handler allows a privileged attacker with control of the migration channel to crash the destination QEMU process or corrupt heap memory. The root cause is a numeric type mismatch - the inflight buffer size is stored as uint64_t but deserialized by the VMS_VBUFFER load path as signed int32_t, so a crafted value with bit 31 set wraps to a massive size_t, causing qemu_get_buffer() to read far beyond the mmap-backed inflight region. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 4.4 reflects the realistic high-privilege barrier to exploitation.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.
Local privilege escalation in the Windows NTFS file-system driver lets an authenticated low-privileged user gain elevated (likely SYSTEM) privileges by exploiting an incorrect conversion between numeric types (CWE-681). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Microsoft reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text fed to that interface to read process memory beyond the input buffer, cause silent acceptance of a truncated document fragment as complete, or terminate the host process. Affected systems are any C++ applications embedding the driver that parse externally-controlled JSON; MongoDB server connectivity, credentials, and non-default configuration are explicitly not required. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects both the constraint of requiring very large input documents and the local library-consumer trust boundary.
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cause applications to silently store truncated or dropped numeric fields. CWE-681 (incorrect conversion between numeric types) triggers when an oversized text-encoded numeric value is parsed: the driver returns a success result while the resulting BSON silently shortens or omits the field entirely. Applications depending on this library for accurate numeric representation - without independent input validation - may persist corrupt data without any indication of failure, creating exploitable logical inconsistencies. No public exploit code or active exploitation has been identified at time of analysis.
Process termination via out-of-bounds memory read affects the MongoDB C++ Driver's BSON document builder, caused by a numeric type conversion error (CWE-681) that misinterprets a field name length when an application supplies an extremely large, non-null-terminated field name in a specific form. All versions of the C++ Driver are indicated as in scope per the wildcard CPE. No public exploit code and no CISA KEV listing exist at time of analysis; MongoDB's own Jira (CXX-3548) is the sole public tracking reference, and no fixed release version has been disclosed in the available data.
Integer underflow in libjxl's container box parser before v0.12.0 allows unauthenticated remote attackers to inject arbitrary image metadata into JPEG XL files decoded on 32-bit platforms. The flaw arises from silent truncation of 64-bit ISOBMFF-style box sizes to the narrower size_t type, causing the decoder to misinterpret attacker-controlled codestream bytes as phantom box headers and insert forged Exif, XMP, IPTC, or JUMBF metadata blocks into its internal state. A secondary effect is potential out-of-bounds memory reads, though no active exploitation or public proof-of-concept code has been identified; a vendor patch is available in v0.12.0.
Privilege escalation in su-exec through version 0.3 allows local attackers with low-privilege access to execute arbitrary programs as root by supplying crafted oversized numeric user or group identifiers. The root cause is an unchecked integer truncation: strtol() returns a 64-bit long on modern Linux, but su-exec assigns the result directly to uid_t and gid_t (32-bit unsigned integers) without range validation - values like 4294967296 (2^32) silently truncate to UID/GID 0, the root account. A public proof-of-concept is available and no vendor-released patch has been identified at time of analysis, making this an active remediation gap for container deployments dependent on su-exec.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the `writeString()` method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds memory copy in QEMU's vhost inflight migration VMState handler allows a privileged attacker with control of the migration channel to crash the destination QEMU process or corrupt heap memory. The root cause is a numeric type mismatch - the inflight buffer size is stored as uint64_t but deserialized by the VMS_VBUFFER load path as signed int32_t, so a crafted value with bit 31 set wraps to a massive size_t, causing qemu_get_buffer() to read far beyond the mmap-backed inflight region. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 4.4 reflects the realistic high-privilege barrier to exploitation.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.
Local privilege escalation in the Windows NTFS file-system driver lets an authenticated low-privileged user gain elevated (likely SYSTEM) privileges by exploiting an incorrect conversion between numeric types (CWE-681). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Microsoft reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.