Integer Overflow
Monthly
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Remote denial-of-service and potential information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arises from an integer underflow (CWE-190 class) reachable over the network without authentication. An unauthenticated remote attacker can send crafted input that triggers the arithmetic wraparound, crashing an affected service and possibly reading sensitive memory contents. There is no public exploit identified at time of analysis, EPSS is low (0.51%, 41st percentile), and it is not on CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, arises from an integer overflow (CWE-190) during a size computation that a remote attacker can trigger to run arbitrary code. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation with no user interaction, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximal CVSS and RCE nature make this a top-priority patch for affected Power/AIX estates.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers via an integer overflow (CWE-190) in a network-reachable component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication and no special configuration, making all internet- or network-exposed instances directly at risk. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.
Heap buffer overflow in hank-ai/darknet's convolutional layer initialization corrupts process memory when a crafted .cfg model configuration is loaded, because layer weight and output buffer sizes are derived from unchecked 32-bit integer multiplication of configuration-supplied fields, allowing the product to wrap to zero or a small value. Darknet versions through 6.0 are affected, and no valid .weights file is required to trigger the flaw - the .cfg alone is sufficient. A publicly available proof of concept demonstrates both an out-of-bounds read under AddressSanitizer and glibc allocator metadata corruption in a release build, confirming that exploitation does not require deep reverse engineering.
Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.
Remote code execution in GIMP 3.2.2 is achievable when a user opens a crafted APNG file, triggering an integer overflow before buffer allocation in the APNG parser (CWE-190). Disclosed by Zero Day Initiative as ZDI-CAN-29401/ZDI-26-462 and tracked as EUVD-2026-63458, the flaw yields full C/I/A compromise within the GIMP process. No active exploitation is confirmed (not listed in CISA KEV), but a fix commit is available on GNOME GitLab; no officially tagged patched release has been independently confirmed at time of analysis.
Remote code execution in GIMP 3.2.2 is achievable via a specially crafted TIF image file that triggers an integer overflow in the application's TIFF parser, causing an undersized heap allocation and subsequent memory corruption. An attacker who convinces a user to open a malicious file or visit an attacker-controlled page that delivers such a file can execute arbitrary code with the privileges of the victim's user account. No public exploit identified at time of analysis, though the ZDI origin (ZDI-26-461, formerly ZDI-CAN-29405) represents a technically verified, researcher-confirmed vulnerability with well-characterized root cause.
Remote code execution is possible in GIMP 3.2.2 through a maliciously crafted SGI image file, exploiting an integer overflow in the application's SGI file parser. An unauthenticated remote attacker can deliver the file via email or web and, upon the victim opening it, execute arbitrary code within the GIMP process context with the privileges of the logged-in user. No active exploitation has been confirmed (not in CISA KEV), though ZDI's coordinated public disclosure via ZDI-26-459 lowers the barrier to weaponization; an upstream patch commit exists but a formally tagged fixed release has not been independently confirmed.
Remote code execution in GIMP 3.2.2 is achievable by an attacker who can convince a target user to open a specially crafted TIF file, triggering an integer overflow during buffer allocation in the TIFF parser that leads to heap corruption and arbitrary code execution in the context of the current user process. Disclosed by the Zero Day Initiative under ZDI-26-458 (ZDI-CAN-29406), the flaw is rooted in missing validation of user-supplied size data before heap allocation. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog; however, an upstream fix commit is available in the GIMP GitLab repository.
Remote code execution via maliciously crafted TIF files affects GIMP 3.2.2, allowing an attacker to execute arbitrary code in the context of the running GIMP process with full user-level privileges. The root cause is a CWE-190 integer overflow in the TIFF file parser where attacker-supplied image metadata bypasses size validation before a heap allocation, enabling memory corruption and code execution. Reported by Zero Day Initiative as ZDI-CAN-29403 and tracked under ENISA EUVD-2026-63453; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in GIMP 3.2.2 is triggered when a victim opens a specially crafted PSD file, exploiting an integer overflow in the PSD parser that occurs before buffer allocation. Tracked by Zero Day Initiative as ZDI-CAN-29395 and rated CVSS 7.8, the flaw allows an unauthenticated remote attacker to execute arbitrary code within the GIMP process context after inducing the target to open a malicious file. No public exploit identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Remote code execution in GIMP 3.2.2 is possible when a user opens a specially crafted HDR image file, with the underlying flaw residing in the GEGL image processing library that GIMP depends on. The integer overflow in HDR buffer size computation (CWE-190) produces an undersized heap allocation that an attacker can leverage to execute arbitrary code in the context of the victim's GIMP process. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed; the ZDI advisory (ZDI-26-453) assigns this a High severity rating of CVSS 7.8.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Remote code execution in IBM AIX 7.2 and 7.3, and in the IBM PowerVM VIOS 4.1 virtualization stack, stems from an integer overflow (CWE-190) that a network-based attacker can trigger without authentication or user interaction. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was supplied in the input.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. No public exploit or CISA KEV listing exists at time of analysis; however, the combination of complete C/I/A impact and scope change makes this a high-priority patch target for any organization running affected IBM Power hardware.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Out-of-bounds kernel heap read and write in FreeBSD's semctl(2) GETALL and SETALL commands enable local privilege escalation by exploiting a 15-bit sequence-number wraparound in the System V semaphore subsystem. FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2 are affected. An unprivileged local attacker races two processes - one cycling semaphore set destruction and recreation to wrap the 0x8000-bounded counter, another issuing GETALL or SETALL at the moment of wrap - causing the kernel to copy semaphore values using a mismatched buffer size and producing exploitable heap corruption. No public exploit code has been identified at time of analysis, but the vulnerability class (local kernel heap OOB via IPC race) is a consistently weaponized primitive for privilege escalation.
Heap buffer overflow in the baresip 'libre' real-time communications library (versions prior to 4.8.1) lets remote attackers corrupt heap memory or crash any application running a WebSocket server via websock_accept()/websock_accept_proto(). The websock_decode() function miscalculates frame bounds for 64-bit extended-length masked frames, and the out-of-bounds XOR unmasking write is attacker-controlled. No public exploit identified at time of analysis, but the flaw is network-reachable and unauthenticated per the CVSS vector.
Integer overflow in Dragonfly's Count-Min Sketch implementation prior to v1.40.0 allows unauthenticated remote clients to corrupt adjacent heap memory, partially disclose heap contents, and crash the server. The flaw exists in src/core/cms.cc: CMS.INITBYDIM and CMS.INITBYPROB accept width/depth parameters whose product with sizeof(int64_t) overflows size_t, causing the allocator to receive a truncated length and produce an undersized buffer; CMS.INCRBY and CMS.QUERY then operate with the original large dimensions, writing and reading past the end of that buffer. No public exploit code has been identified at time of analysis, but the CVSS 4.0 vector confirms unauthenticated network exploitation with no preconditions, rating this 8.8.
Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Integer overflow in Apple's image processing subsystem across iOS, iPadOS, and macOS Tahoe allows arbitrary code execution when a user processes a maliciously crafted image. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing out-of-band point releases indicating urgency. No public exploit has been identified at time of analysis, but the CVSS 8.8 score and SSVC total technical impact rating place this among high-priority patching targets given Apple's massive consumer and enterprise device footprint.
Financial fraud via integer overflow in QuantumNous New API (an LLM gateway and AI asset-management platform) lets a low-privileged account with a positive balance or active subscription manipulate user-controlled billing multipliers so that a computed charge wraps into account credit and can drain upstream provider funds. The flaw sits in quota settlement math (common/quota_math.go and related paths) across image, video, audio, and token-count fields, and is fixed in 1.0.0-rc.18. There is no public exploit identified at time of analysis, but the upstream fix commits and GHSA advisory publicly disclose the vulnerable code paths.
Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.
Signed integer overflow in rsync 3.1.0 through 3.4.x allows network-accessible attackers to permanently disable connection timeouts on a daemon by injecting crafted MSG_IO_TIMEOUT messages carrying zero or negative values, ultimately enabling resource exhaustion via indefinitely held daemon slots. All deployments running the rsync daemon in the affected range are exposed; the fix is confirmed in rsync 3.5.0, released as a major security update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-privilege, low-complexity network attack path makes unpatched internet-facing daemons a meaningful target.
Remote code execution via integer wraparound in PostgreSQL's fuzzystrmatch contrib module allows any authenticated database user to corrupt memory and execute arbitrary code as the operating system account running the database server. All maintained PostgreSQL branches are affected: versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE impact, low attack complexity, and network accessibility establish this as a high-priority patching target.
Integer wraparound in 32-bit builds of PostgreSQL's PL/Tcl and PL/Perl procedural language extensions enables an authenticated object creator to provoke an undersized heap allocation and perform an out-of-bounds write via a crafted function body, ultimately achieving arbitrary code execution as the OS user running the database process. PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24 across active major release branches are affected. This is a recurrence of the class of integer arithmetic flaws previously addressed by CVE-2026-6473, indicating an incomplete prior remediation; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer wraparound in PostgreSQL's tsvector and tsquery full-text search functions allows an unprivileged database user to trigger an undersized heap allocation and subsequently write out-of-bounds, with potential for arbitrary code execution as the operating system user running the database process. All supported major release lines are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - and the vulnerability closely mirrors CVE-2026-6473, which addressed a similar integer overflow class in the same subsystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating with full High C/I/A impact reflects the worst-case consequence of successful exploitation.
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a victim into opening a specially crafted malicious file, exploiting an integer overflow in the application's file parsing logic (CWE-190). The flaw yields full compromise of confidentiality, integrity, and availability within the current user's context, consistent with the CVSS 7.8 score. Adobe has released a patch in version 15.5 per advisory APSB26-94; no public exploit has been identified at time of analysis.
Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. No public exploit has been identified at time of analysis, but fixes are confirmed available in GitHub releases 3.3.12 and 5.1.11.
Remote code execution in Microsoft Office Outlook stems from an integer overflow or wraparound condition (CWE-190) that allows an unauthenticated network attacker to execute arbitrary code on a victim's system, achieving full confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R reflects low attack complexity and no authentication requirement, though exploitation is gated by a user interaction step. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the attack profile is consistent with phishing-delivered malicious email or attachment campaigns targeting Outlook users.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.
Privilege escalation in the Windows Program Compatibility Assistant (PCA) Service, affecting a broad range of Windows 10, Windows 11, and Windows Server releases, stems from an integer underflow (CWE-191) that an authenticated local attacker can trigger to gain elevated - likely SYSTEM-level - privileges. The vulnerability requires only low-privileged local access with no user interaction, producing total confidentiality, integrity, and availability impact per the CVSS vector. SSVC assessment confirms no exploitation activity at time of analysis and no public exploit code has been identified.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Integer overflow in Vim's text-property subsystem (prior to 9.2.0841) allows a crafted file to wrap a uint16_t line-property counter from 0xffff to zero, causing prop_add_one() in src/textprop.c to copy existing text-property records into a heap allocation sized for zero entries. The resulting heap corruption can yield high-impact confidentiality, integrity, and availability consequences on the local user's process. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.1 (AV:L/AC:H) reflects meaningful risk for users who open untrusted files in Vim.
Denial of service in Red Hat JBoss Enterprise Application Platform's jboss-remoting component allows any remote unauthenticated attacker who can reach application or management ports to exhaust server memory through a crafted protocol handshake. By completing an Upgrade: jboss-remoting handshake on ports 8080, 9990, or 4447, an attacker triggers an integer overflow (CWE-190) that causes uncontrolled heap allocation, inducing OOM errors that degrade or halt request processing server-wide. No public exploit has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.
Remote code execution within the Chrome sandbox via an integer overflow in the V8 JavaScript engine affects Google Chrome prior to version 151.0.7922.109. An unauthenticated remote attacker can trigger the flaw by enticing a user to visit a specially crafted HTML page, resulting in full compromise of confidentiality, integrity, and availability within the renderer process. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, though the total technical impact and low attack complexity elevate real-world priority for patching.
Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Integer underflow in the raster Rust crate's crop() function enables remote process crash via a single crafted request. When offset_x or offset_y exceeds the source image dimension, the signed subtraction wraps to a large negative i32 in release builds; that value is then cast to usize and passed to Vec::with_capacity(), triggering an unrecoverable capacity-overflow panic that kills the host process. No active exploitation is confirmed (not in CISA KEV) and no public POC is listed, but the AV:N/AC:L/PR:N/UI:N CVSS vector indicates zero-friction denial-of-service for any application that exposes the crop() call to untrusted input.
SIP message smuggling in OpenSIPS via unsigned integer overflow in TCP Content-Length parsing enables unauthenticated remote attackers to inject arbitrary SIP messages that bypass front-end SBC and proxy security policies, inherit connection authentication context, and evade rate limiting. All OpenSIPS instances with any TCP-based transport enabled (proto_tcp, proto_tls, proto_ws, proto_wss) running versions prior to 3.6.6 or 4.0.0-rc1 are affected, with no routing-script preconditions required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires only a single malformed packet against a default TCP-enabled configuration.
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.
Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.
Integer overflow in the UA_Variant arrayDimensions product computation in open62541 (versions 1.3.0-1.3.18, 1.4.0-1.4.17, 1.5.0-1.5.5) enables a remote attacker to trigger an out-of-bounds heap write, with potential for denial of service or arbitrary code execution in industrial OPC UA servers and gateways. CISA coordinated disclosure as ICSA-26-211-08 on 2026-07-30, citing risk to critical manufacturing, energy, and transportation infrastructure sectors worldwide. No public exploit identified at time of analysis - PoC code exists but was withheld at o6 Automation's request; the CVE is not in CISA KEV.
Unsigned integer underflow in open62541's PubSub signature verification path enables an unauthenticated remote attacker to crash an OPC UA server with a single crafted UDP packet. Affected across versions 1.3.0-1.3.18, 1.4.0-1.4.17, and 1.5.0-1.5.5 on Windows and Linux, exploitation requires a non-default build with PubSub encryption enabled and a ReaderGroup in SIGN or SIGNANDENCRYPT mode - but demands no session, credentials, or prior authentication. Patches were released 2026-07-27 and CISA published ICS advisory ICSA-26-211-08 on 2026-07-30; proof-of-concept code is withheld at o6 Automation's request and no KEV listing is present, meaning active exploitation is not confirmed at time of analysis.
Out-of-bounds heap read in the open62541 OPC UA C library allows a remote unauthenticated attacker to disclose sensitive process memory by supplying a crafted UA_Variant whose arrayDimensions provoke an integer overflow in the dimension-product computation. The overflow makes the computed element/stride total wrap to a small value, so bounds checks pass and subsequent index math walks past the heap allocation. CVSS 4.0 is 8.7 (confidentiality-only impact); no public exploit identified at time of analysis, though it is tracked in a CISA ICS advisory (ICSA-26-211-08) given the industrial/OT exposure of OPC UA servers.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.
Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page that triggers an integer overflow in the bundled libxml component. Google rated the flaw High severity and a vendor patch is available; there is no public exploit identified at time of analysis, and the low EPSS score (0.35%) alongside CISA SSVC 'Exploitation: none' indicates no observed exploitation yet. Because the bug is contained to the sandboxed renderer, a successful attacker would still need a separate sandbox-escape to reach the host.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.
Remote code execution in Autel MaxiCharger AC Elite Home EV chargers allows unauthenticated network attackers to run arbitrary code on the device by exploiting an integer underflow in the OCPP WebSocket message handler. The flaw stems from missing validation of user-supplied length/size data used in a buffer allocation, giving full compromise of the charger. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately through Zero Day Initiative (ZDI-26-437 / ZDI-CAN-29113).
Out-of-bounds write in the pgvector PostgreSQL extension (versions before 0.8.6) lets an authenticated database user trigger an integer wraparound during IVFFlat index construction, corrupting heap memory in the backend process and potentially achieving arbitrary code execution. The flaw is exploitable only on 32-bit systems, where size calculations in the k-means clustering routine overflow the Size type. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
An integer underflow in the MP3 decoder of ESP32-audioI2S v3.4.5 allows potential arbitrary code execution via a specially crafted MP3 file. The vulnerability, caused by unchecked bit reading operations in the MP3Decoder::GetBits() function, can lead to invalid bit manipulation, application crash, or code execution. Exploitation requires a user to open a malicious MP
Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.
Processing a maliciously crafted file on Apple operating systems can lead to arbitrary code execution due to an integer overflow vulnerability (CWE-190). Affected products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, all prior to their respective fixed versions. No public exploit code has been identified, and the EPSS score of 0.17% indicates a very low probability of near-term exploitation, though the impact could be severe.
An integer overflow vulnerability in macOS can be triggered by a malicious app to cause unexpected system termination, effectively a denial-of-service. The flaw affects macOS versions prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. Although the public CVSS score suggests critical remote code execution, the actual impact appears limited to system crashes, and there is no evidence of active exploitation or public proof-of-concept code.
Unexpected system termination in Apple macOS allows a local application to trigger an integer overflow, causing denial-of-service. Versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 are affected. The vulnerability has a low exploitation likelihood (EPSS 0.16%) and no known active exploitation or public exploit code.
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sources: CVE description, CVSS, EPSS, CPE, tags, references, ENISA data. The output must be plain text paragraphs, not arrays/objects. Let's analyze the input: - CVE-2026-64774 - Description: "An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption." - CVSS Score: 9.8, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-190 (Integer Overflow) - EPSS: 0.24%, percentile 16% (low) - Patch: Available from vendor (confirmed by description listing fixed versions) - Reported by: apple - CPE: multiple Apple products: iOS and iPadOS, macOS, tvOS, visionOS - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Integer Overflow (note "Buffer Overflow" tag but it's integer overflow leading to heap corruption, maybe buffer overflow is a result) - ENISA EUVD: affected versions listed: macOS 0 <26.6, macOS 0 <15.7.8, iOS and iPadOS 0 <26.6, macOS 0 <14.8.8, visionOS 0 <26.6, tvOS 0 <26.6. It's weird: "macOS 0 <26.6" maybe means all macOS before 26.6? But they also mention specific Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6. So the affected versions are those prior to these specific fixed versions? - References: many Apple support URLs (128066 to 128072), likely each for a product. Given the description, the integer overflow exists in some component (maybe kernel, a library) across Apple operating systems. It can be triggered remotely by an attacker, leading to unexpected application termination (DoS) or heap corruption (potentially code execution). CVSS says complete confidentiality, integrity, availability impact, but EPSS is low, KEV not mentioned. No POC mentioned. Tags include "Buffer Overflow" which might
Untrusted texture processing on unpatched Apple devices triggers an integer overflow (CWE-190) in a graphics/texture-parsing component, causing the affected application to terminate unexpectedly. The flaw affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, and macOS Tahoe, tvOS, visionOS and watchOS before 26.6; exploitation requires local access plus user interaction, specifically the victim opening or rendering an attacker-supplied texture (CVSS AV:L/UI:R). Multiple independent signals point to low real-world risk: EPSS is only 0.17% (6th percentile), there is no CISA KEV entry, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the demonstrated consequence is availability loss (app termination), not proven code execution, and vendor patches are already available for every affected platform.
Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.
Erlang/OTP nodes that decode External Term Format (ETF) from untrusted sources can be aborted outright by a single malformed term, in versions from OTP 27.0 up to but not including the fixed releases OTP 29.0.4, 28.5.0.4 and 27.3.4.15 (erts 15.0 up to 17.0.4, 16.4.0.4 and 15.2.7.11). The BIT_BINARY_EXT tag (77) handler accepts an encoding with zero length and zero trailing bits, causing an unsigned underflow in the computed bitstring size; the resulting value near 2^64 is handed to the allocator, which terminates the entire VM with an abort rather than raising a catchable Erlang exception. The vulnerability is unauthenticated (CVSS 4.0 vector PR:N) but requires the target application to feed attacker-controlled bytes into binary_to_term/1,2 or enif_binary_to_term(), an application-design precondition reflected as AT:P in the vendor vector and assessed as AC:H in our CVSS 3.1 evaluation; impact is availability-only (C:N/I:N/A:H). There is no indication of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.32% (24th percentile), and no public exploit code has been identified at time of analysis. Vendor-released patches are available.
Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the `net.ipv4.tcp_reordering` sysctl causes a silent type-coercion wrap when the value is copied into the `u32 tp->reordering` field, producing an enormous effective value. When `tcp_mtu_probing=2` is also active, this wrapped value overflows the `size_needed` computation in `tcp_mtu_probe()`, bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.
Integer wrap-around in the Linux kernel's HFS/HFS+ filesystem driver allows a local low-privileged user to bypass a critical bounds check, triggering a memmove that reads approximately 4GB past a node buffer in kernel memory. The flaw originates in check_and_correct_requested_length(), where u32 arithmetic on off+len wraps silently when len arrives as a large underflowed value from hfs_brec_remove(); the wrapped result passes the node_size guard and proceeds to an out-of-bounds memory operation. No public exploit has been identified at time of analysis, and EPSS stands at 0.22%, reflecting low real-world exploitation expectation despite full C:H/I:H/A:H impact ratings.
Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.
Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.
Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Remote denial-of-service and potential information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arises from an integer underflow (CWE-190 class) reachable over the network without authentication. An unauthenticated remote attacker can send crafted input that triggers the arithmetic wraparound, crashing an affected service and possibly reading sensitive memory contents. There is no public exploit identified at time of analysis, EPSS is low (0.51%, 41st percentile), and it is not on CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, arises from an integer overflow (CWE-190) during a size computation that a remote attacker can trigger to run arbitrary code. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation with no user interaction, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximal CVSS and RCE nature make this a top-priority patch for affected Power/AIX estates.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers via an integer overflow (CWE-190) in a network-reachable component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication and no special configuration, making all internet- or network-exposed instances directly at risk. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.
Heap buffer overflow in hank-ai/darknet's convolutional layer initialization corrupts process memory when a crafted .cfg model configuration is loaded, because layer weight and output buffer sizes are derived from unchecked 32-bit integer multiplication of configuration-supplied fields, allowing the product to wrap to zero or a small value. Darknet versions through 6.0 are affected, and no valid .weights file is required to trigger the flaw - the .cfg alone is sufficient. A publicly available proof of concept demonstrates both an out-of-bounds read under AddressSanitizer and glibc allocator metadata corruption in a release build, confirming that exploitation does not require deep reverse engineering.
Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.
Remote code execution in GIMP 3.2.2 is achievable when a user opens a crafted APNG file, triggering an integer overflow before buffer allocation in the APNG parser (CWE-190). Disclosed by Zero Day Initiative as ZDI-CAN-29401/ZDI-26-462 and tracked as EUVD-2026-63458, the flaw yields full C/I/A compromise within the GIMP process. No active exploitation is confirmed (not listed in CISA KEV), but a fix commit is available on GNOME GitLab; no officially tagged patched release has been independently confirmed at time of analysis.
Remote code execution in GIMP 3.2.2 is achievable via a specially crafted TIF image file that triggers an integer overflow in the application's TIFF parser, causing an undersized heap allocation and subsequent memory corruption. An attacker who convinces a user to open a malicious file or visit an attacker-controlled page that delivers such a file can execute arbitrary code with the privileges of the victim's user account. No public exploit identified at time of analysis, though the ZDI origin (ZDI-26-461, formerly ZDI-CAN-29405) represents a technically verified, researcher-confirmed vulnerability with well-characterized root cause.
Remote code execution is possible in GIMP 3.2.2 through a maliciously crafted SGI image file, exploiting an integer overflow in the application's SGI file parser. An unauthenticated remote attacker can deliver the file via email or web and, upon the victim opening it, execute arbitrary code within the GIMP process context with the privileges of the logged-in user. No active exploitation has been confirmed (not in CISA KEV), though ZDI's coordinated public disclosure via ZDI-26-459 lowers the barrier to weaponization; an upstream patch commit exists but a formally tagged fixed release has not been independently confirmed.
Remote code execution in GIMP 3.2.2 is achievable by an attacker who can convince a target user to open a specially crafted TIF file, triggering an integer overflow during buffer allocation in the TIFF parser that leads to heap corruption and arbitrary code execution in the context of the current user process. Disclosed by the Zero Day Initiative under ZDI-26-458 (ZDI-CAN-29406), the flaw is rooted in missing validation of user-supplied size data before heap allocation. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog; however, an upstream fix commit is available in the GIMP GitLab repository.
Remote code execution via maliciously crafted TIF files affects GIMP 3.2.2, allowing an attacker to execute arbitrary code in the context of the running GIMP process with full user-level privileges. The root cause is a CWE-190 integer overflow in the TIFF file parser where attacker-supplied image metadata bypasses size validation before a heap allocation, enabling memory corruption and code execution. Reported by Zero Day Initiative as ZDI-CAN-29403 and tracked under ENISA EUVD-2026-63453; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in GIMP 3.2.2 is triggered when a victim opens a specially crafted PSD file, exploiting an integer overflow in the PSD parser that occurs before buffer allocation. Tracked by Zero Day Initiative as ZDI-CAN-29395 and rated CVSS 7.8, the flaw allows an unauthenticated remote attacker to execute arbitrary code within the GIMP process context after inducing the target to open a malicious file. No public exploit identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Remote code execution in GIMP 3.2.2 is possible when a user opens a specially crafted HDR image file, with the underlying flaw residing in the GEGL image processing library that GIMP depends on. The integer overflow in HDR buffer size computation (CWE-190) produces an undersized heap allocation that an attacker can leverage to execute arbitrary code in the context of the victim's GIMP process. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed; the ZDI advisory (ZDI-26-453) assigns this a High severity rating of CVSS 7.8.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Remote code execution in IBM AIX 7.2 and 7.3, and in the IBM PowerVM VIOS 4.1 virtualization stack, stems from an integer overflow (CWE-190) that a network-based attacker can trigger without authentication or user interaction. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was supplied in the input.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. No public exploit or CISA KEV listing exists at time of analysis; however, the combination of complete C/I/A impact and scope change makes this a high-priority patch target for any organization running affected IBM Power hardware.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Out-of-bounds kernel heap read and write in FreeBSD's semctl(2) GETALL and SETALL commands enable local privilege escalation by exploiting a 15-bit sequence-number wraparound in the System V semaphore subsystem. FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2 are affected. An unprivileged local attacker races two processes - one cycling semaphore set destruction and recreation to wrap the 0x8000-bounded counter, another issuing GETALL or SETALL at the moment of wrap - causing the kernel to copy semaphore values using a mismatched buffer size and producing exploitable heap corruption. No public exploit code has been identified at time of analysis, but the vulnerability class (local kernel heap OOB via IPC race) is a consistently weaponized primitive for privilege escalation.
Heap buffer overflow in the baresip 'libre' real-time communications library (versions prior to 4.8.1) lets remote attackers corrupt heap memory or crash any application running a WebSocket server via websock_accept()/websock_accept_proto(). The websock_decode() function miscalculates frame bounds for 64-bit extended-length masked frames, and the out-of-bounds XOR unmasking write is attacker-controlled. No public exploit identified at time of analysis, but the flaw is network-reachable and unauthenticated per the CVSS vector.
Integer overflow in Dragonfly's Count-Min Sketch implementation prior to v1.40.0 allows unauthenticated remote clients to corrupt adjacent heap memory, partially disclose heap contents, and crash the server. The flaw exists in src/core/cms.cc: CMS.INITBYDIM and CMS.INITBYPROB accept width/depth parameters whose product with sizeof(int64_t) overflows size_t, causing the allocator to receive a truncated length and produce an undersized buffer; CMS.INCRBY and CMS.QUERY then operate with the original large dimensions, writing and reading past the end of that buffer. No public exploit code has been identified at time of analysis, but the CVSS 4.0 vector confirms unauthenticated network exploitation with no preconditions, rating this 8.8.
Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Integer overflow in Apple's image processing subsystem across iOS, iPadOS, and macOS Tahoe allows arbitrary code execution when a user processes a maliciously crafted image. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing out-of-band point releases indicating urgency. No public exploit has been identified at time of analysis, but the CVSS 8.8 score and SSVC total technical impact rating place this among high-priority patching targets given Apple's massive consumer and enterprise device footprint.
Financial fraud via integer overflow in QuantumNous New API (an LLM gateway and AI asset-management platform) lets a low-privileged account with a positive balance or active subscription manipulate user-controlled billing multipliers so that a computed charge wraps into account credit and can drain upstream provider funds. The flaw sits in quota settlement math (common/quota_math.go and related paths) across image, video, audio, and token-count fields, and is fixed in 1.0.0-rc.18. There is no public exploit identified at time of analysis, but the upstream fix commits and GHSA advisory publicly disclose the vulnerable code paths.
Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.
Signed integer overflow in rsync 3.1.0 through 3.4.x allows network-accessible attackers to permanently disable connection timeouts on a daemon by injecting crafted MSG_IO_TIMEOUT messages carrying zero or negative values, ultimately enabling resource exhaustion via indefinitely held daemon slots. All deployments running the rsync daemon in the affected range are exposed; the fix is confirmed in rsync 3.5.0, released as a major security update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-privilege, low-complexity network attack path makes unpatched internet-facing daemons a meaningful target.
Remote code execution via integer wraparound in PostgreSQL's fuzzystrmatch contrib module allows any authenticated database user to corrupt memory and execute arbitrary code as the operating system account running the database server. All maintained PostgreSQL branches are affected: versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE impact, low attack complexity, and network accessibility establish this as a high-priority patching target.
Integer wraparound in 32-bit builds of PostgreSQL's PL/Tcl and PL/Perl procedural language extensions enables an authenticated object creator to provoke an undersized heap allocation and perform an out-of-bounds write via a crafted function body, ultimately achieving arbitrary code execution as the OS user running the database process. PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24 across active major release branches are affected. This is a recurrence of the class of integer arithmetic flaws previously addressed by CVE-2026-6473, indicating an incomplete prior remediation; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer wraparound in PostgreSQL's tsvector and tsquery full-text search functions allows an unprivileged database user to trigger an undersized heap allocation and subsequently write out-of-bounds, with potential for arbitrary code execution as the operating system user running the database process. All supported major release lines are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - and the vulnerability closely mirrors CVE-2026-6473, which addressed a similar integer overflow class in the same subsystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating with full High C/I/A impact reflects the worst-case consequence of successful exploitation.
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a victim into opening a specially crafted malicious file, exploiting an integer overflow in the application's file parsing logic (CWE-190). The flaw yields full compromise of confidentiality, integrity, and availability within the current user's context, consistent with the CVSS 7.8 score. Adobe has released a patch in version 15.5 per advisory APSB26-94; no public exploit has been identified at time of analysis.
Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. No public exploit has been identified at time of analysis, but fixes are confirmed available in GitHub releases 3.3.12 and 5.1.11.
Remote code execution in Microsoft Office Outlook stems from an integer overflow or wraparound condition (CWE-190) that allows an unauthenticated network attacker to execute arbitrary code on a victim's system, achieving full confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R reflects low attack complexity and no authentication requirement, though exploitation is gated by a user interaction step. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the attack profile is consistent with phishing-delivered malicious email or attachment campaigns targeting Outlook users.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.
Privilege escalation in the Windows Program Compatibility Assistant (PCA) Service, affecting a broad range of Windows 10, Windows 11, and Windows Server releases, stems from an integer underflow (CWE-191) that an authenticated local attacker can trigger to gain elevated - likely SYSTEM-level - privileges. The vulnerability requires only low-privileged local access with no user interaction, producing total confidentiality, integrity, and availability impact per the CVSS vector. SSVC assessment confirms no exploitation activity at time of analysis and no public exploit code has been identified.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Integer overflow in Vim's text-property subsystem (prior to 9.2.0841) allows a crafted file to wrap a uint16_t line-property counter from 0xffff to zero, causing prop_add_one() in src/textprop.c to copy existing text-property records into a heap allocation sized for zero entries. The resulting heap corruption can yield high-impact confidentiality, integrity, and availability consequences on the local user's process. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.1 (AV:L/AC:H) reflects meaningful risk for users who open untrusted files in Vim.
Denial of service in Red Hat JBoss Enterprise Application Platform's jboss-remoting component allows any remote unauthenticated attacker who can reach application or management ports to exhaust server memory through a crafted protocol handshake. By completing an Upgrade: jboss-remoting handshake on ports 8080, 9990, or 4447, an attacker triggers an integer overflow (CWE-190) that causes uncontrolled heap allocation, inducing OOM errors that degrade or halt request processing server-wide. No public exploit has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.
Remote code execution within the Chrome sandbox via an integer overflow in the V8 JavaScript engine affects Google Chrome prior to version 151.0.7922.109. An unauthenticated remote attacker can trigger the flaw by enticing a user to visit a specially crafted HTML page, resulting in full compromise of confidentiality, integrity, and availability within the renderer process. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, though the total technical impact and low attack complexity elevate real-world priority for patching.
Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Integer underflow in the raster Rust crate's crop() function enables remote process crash via a single crafted request. When offset_x or offset_y exceeds the source image dimension, the signed subtraction wraps to a large negative i32 in release builds; that value is then cast to usize and passed to Vec::with_capacity(), triggering an unrecoverable capacity-overflow panic that kills the host process. No active exploitation is confirmed (not in CISA KEV) and no public POC is listed, but the AV:N/AC:L/PR:N/UI:N CVSS vector indicates zero-friction denial-of-service for any application that exposes the crop() call to untrusted input.
SIP message smuggling in OpenSIPS via unsigned integer overflow in TCP Content-Length parsing enables unauthenticated remote attackers to inject arbitrary SIP messages that bypass front-end SBC and proxy security policies, inherit connection authentication context, and evade rate limiting. All OpenSIPS instances with any TCP-based transport enabled (proto_tcp, proto_tls, proto_ws, proto_wss) running versions prior to 3.6.6 or 4.0.0-rc1 are affected, with no routing-script preconditions required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires only a single malformed packet against a default TCP-enabled configuration.
Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.
Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.
Integer overflow in the UA_Variant arrayDimensions product computation in open62541 (versions 1.3.0-1.3.18, 1.4.0-1.4.17, 1.5.0-1.5.5) enables a remote attacker to trigger an out-of-bounds heap write, with potential for denial of service or arbitrary code execution in industrial OPC UA servers and gateways. CISA coordinated disclosure as ICSA-26-211-08 on 2026-07-30, citing risk to critical manufacturing, energy, and transportation infrastructure sectors worldwide. No public exploit identified at time of analysis - PoC code exists but was withheld at o6 Automation's request; the CVE is not in CISA KEV.
Unsigned integer underflow in open62541's PubSub signature verification path enables an unauthenticated remote attacker to crash an OPC UA server with a single crafted UDP packet. Affected across versions 1.3.0-1.3.18, 1.4.0-1.4.17, and 1.5.0-1.5.5 on Windows and Linux, exploitation requires a non-default build with PubSub encryption enabled and a ReaderGroup in SIGN or SIGNANDENCRYPT mode - but demands no session, credentials, or prior authentication. Patches were released 2026-07-27 and CISA published ICS advisory ICSA-26-211-08 on 2026-07-30; proof-of-concept code is withheld at o6 Automation's request and no KEV listing is present, meaning active exploitation is not confirmed at time of analysis.
Out-of-bounds heap read in the open62541 OPC UA C library allows a remote unauthenticated attacker to disclose sensitive process memory by supplying a crafted UA_Variant whose arrayDimensions provoke an integer overflow in the dimension-product computation. The overflow makes the computed element/stride total wrap to a small value, so bounds checks pass and subsequent index math walks past the heap allocation. CVSS 4.0 is 8.7 (confidentiality-only impact); no public exploit identified at time of analysis, though it is tracked in a CISA ICS advisory (ICSA-26-211-08) given the industrial/OT exposure of OPC UA servers.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.
Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page that triggers an integer overflow in the bundled libxml component. Google rated the flaw High severity and a vendor patch is available; there is no public exploit identified at time of analysis, and the low EPSS score (0.35%) alongside CISA SSVC 'Exploitation: none' indicates no observed exploitation yet. Because the bug is contained to the sandboxed renderer, a successful attacker would still need a separate sandbox-escape to reach the host.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.
Remote code execution in Autel MaxiCharger AC Elite Home EV chargers allows unauthenticated network attackers to run arbitrary code on the device by exploiting an integer underflow in the OCPP WebSocket message handler. The flaw stems from missing validation of user-supplied length/size data used in a buffer allocation, giving full compromise of the charger. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately through Zero Day Initiative (ZDI-26-437 / ZDI-CAN-29113).
Out-of-bounds write in the pgvector PostgreSQL extension (versions before 0.8.6) lets an authenticated database user trigger an integer wraparound during IVFFlat index construction, corrupting heap memory in the backend process and potentially achieving arbitrary code execution. The flaw is exploitable only on 32-bit systems, where size calculations in the k-means clustering routine overflow the Size type. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
An integer underflow in the MP3 decoder of ESP32-audioI2S v3.4.5 allows potential arbitrary code execution via a specially crafted MP3 file. The vulnerability, caused by unchecked bit reading operations in the MP3Decoder::GetBits() function, can lead to invalid bit manipulation, application crash, or code execution. Exploitation requires a user to open a malicious MP
Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.
Processing a maliciously crafted file on Apple operating systems can lead to arbitrary code execution due to an integer overflow vulnerability (CWE-190). Affected products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, all prior to their respective fixed versions. No public exploit code has been identified, and the EPSS score of 0.17% indicates a very low probability of near-term exploitation, though the impact could be severe.
An integer overflow vulnerability in macOS can be triggered by a malicious app to cause unexpected system termination, effectively a denial-of-service. The flaw affects macOS versions prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. Although the public CVSS score suggests critical remote code execution, the actual impact appears limited to system crashes, and there is no evidence of active exploitation or public proof-of-concept code.
Unexpected system termination in Apple macOS allows a local application to trigger an integer overflow, causing denial-of-service. Versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 are affected. The vulnerability has a low exploitation likelihood (EPSS 0.16%) and no known active exploitation or public exploit code.
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sources: CVE description, CVSS, EPSS, CPE, tags, references, ENISA data. The output must be plain text paragraphs, not arrays/objects. Let's analyze the input: - CVE-2026-64774 - Description: "An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption." - CVSS Score: 9.8, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-190 (Integer Overflow) - EPSS: 0.24%, percentile 16% (low) - Patch: Available from vendor (confirmed by description listing fixed versions) - Reported by: apple - CPE: multiple Apple products: iOS and iPadOS, macOS, tvOS, visionOS - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Integer Overflow (note "Buffer Overflow" tag but it's integer overflow leading to heap corruption, maybe buffer overflow is a result) - ENISA EUVD: affected versions listed: macOS 0 <26.6, macOS 0 <15.7.8, iOS and iPadOS 0 <26.6, macOS 0 <14.8.8, visionOS 0 <26.6, tvOS 0 <26.6. It's weird: "macOS 0 <26.6" maybe means all macOS before 26.6? But they also mention specific Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6. So the affected versions are those prior to these specific fixed versions? - References: many Apple support URLs (128066 to 128072), likely each for a product. Given the description, the integer overflow exists in some component (maybe kernel, a library) across Apple operating systems. It can be triggered remotely by an attacker, leading to unexpected application termination (DoS) or heap corruption (potentially code execution). CVSS says complete confidentiality, integrity, availability impact, but EPSS is low, KEV not mentioned. No POC mentioned. Tags include "Buffer Overflow" which might
Untrusted texture processing on unpatched Apple devices triggers an integer overflow (CWE-190) in a graphics/texture-parsing component, causing the affected application to terminate unexpectedly. The flaw affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, and macOS Tahoe, tvOS, visionOS and watchOS before 26.6; exploitation requires local access plus user interaction, specifically the victim opening or rendering an attacker-supplied texture (CVSS AV:L/UI:R). Multiple independent signals point to low real-world risk: EPSS is only 0.17% (6th percentile), there is no CISA KEV entry, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the demonstrated consequence is availability loss (app termination), not proven code execution, and vendor patches are already available for every affected platform.
Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.
Erlang/OTP nodes that decode External Term Format (ETF) from untrusted sources can be aborted outright by a single malformed term, in versions from OTP 27.0 up to but not including the fixed releases OTP 29.0.4, 28.5.0.4 and 27.3.4.15 (erts 15.0 up to 17.0.4, 16.4.0.4 and 15.2.7.11). The BIT_BINARY_EXT tag (77) handler accepts an encoding with zero length and zero trailing bits, causing an unsigned underflow in the computed bitstring size; the resulting value near 2^64 is handed to the allocator, which terminates the entire VM with an abort rather than raising a catchable Erlang exception. The vulnerability is unauthenticated (CVSS 4.0 vector PR:N) but requires the target application to feed attacker-controlled bytes into binary_to_term/1,2 or enif_binary_to_term(), an application-design precondition reflected as AT:P in the vendor vector and assessed as AC:H in our CVSS 3.1 evaluation; impact is availability-only (C:N/I:N/A:H). There is no indication of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.32% (24th percentile), and no public exploit code has been identified at time of analysis. Vendor-released patches are available.
Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the `net.ipv4.tcp_reordering` sysctl causes a silent type-coercion wrap when the value is copied into the `u32 tp->reordering` field, producing an enormous effective value. When `tcp_mtu_probing=2` is also active, this wrapped value overflows the `size_needed` computation in `tcp_mtu_probe()`, bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.
Integer wrap-around in the Linux kernel's HFS/HFS+ filesystem driver allows a local low-privileged user to bypass a critical bounds check, triggering a memmove that reads approximately 4GB past a node buffer in kernel memory. The flaw originates in check_and_correct_requested_length(), where u32 arithmetic on off+len wraps silently when len arrives as a large underflowed value from hfs_brec_remove(); the wrapped result passes the node_size guard and proceeds to an out-of-bounds memory operation. No public exploit has been identified at time of analysis, and EPSS stands at 0.22%, reflecting low real-world exploitation expectation despite full C:H/I:H/A:H impact ratings.
Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.
Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.
Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.