Integer Overflow
Monthly
A boundary condition vulnerability combined with an integer overflow flaw exists in the Graphics component of Mozilla Firefox, affecting Firefox versions prior to 149, Firefox ESR versions prior to 115.34, and Firefox ESR versions prior to 140.9. This vulnerability could allow an attacker to trigger a buffer overflow through specially crafted graphics data, potentially leading to memory corruption and arbitrary code execution. While no CVSS score or EPSS data is currently available, the Mozilla security advisories confirm the vulnerability affects multiple product lines across different release channels.
A sandbox escape vulnerability exists in Mozilla Firefox due to incorrect boundary conditions and integer overflow within the XPCOM component, allowing attackers to break out of the browser's security sandbox and potentially execute arbitrary code with elevated privileges. Firefox versions below 149, Firefox ESR below 115.34, and Firefox ESR below 140.9 are affected. An attacker capable of triggering the integer overflow in XPCOM can exploit the boundary condition flaw to escape the sandbox, potentially leading to full system compromise depending on browser privilege level and operating system context.
Integer overflow in the Expat XML parser module within InsightSoftwareConsortium ITK before version 2.7.1 allows remote attackers to cause denial of service or potentially execute arbitrary code through specially crafted XML input. The vulnerability affects all users of vulnerable ITK versions and requires only network access and user interaction to exploit. A patch is available in ITK 2.7.1 and later.
Integer overflow in ART's rtengine dcraw.C module before version 1.25.12 allows local attackers with user interaction to achieve high-impact compromise of confidentiality, integrity, and availability. This vulnerability requires local access and user interaction to trigger, making it exploitable primarily through malicious image files or project files opened by victims.
Unauthenticated remote attackers can crash strongSwan versions 4.5.0 through 6.0.4 via integer underflow in the EAP-TTLS AVP parser during IKEv2 authentication by sending malformed AVP packets with invalid length fields. Public exploit code exists for this denial of service vulnerability, which triggers memory corruption in the charon daemon with no available patch. Organizations running affected strongSwan versions are vulnerable to service disruption without authentication or user interaction required.
The Rust libp2p Gossipsub implementation contains an integer overflow vulnerability that allows remote unauthenticated attackers to crash affected nodes by sending a single crafted PRUNE control message with an extremely large backoff value (e.g., u64::MAX). The vulnerability affects the libp2p-gossipsub Rust crate and enables trivial denial of service against any application exposing a Gossipsub listener. This vulnerability was discovered through responsible disclosure to the Ethereum Foundation bug bounty program by @revofusion, and while no active exploitation (KEV) status is indicated, the attack complexity is extremely low and a detailed proof-of-concept attack scenario has been publicly disclosed in the advisory.
HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain a heap buffer overflow vulnerability in the GZI index loading function `bgzf_index_load_hfile()`. An integer overflow during buffer allocation allows attackers to craft malicious `.gzi` files that trigger heap memory corruption, potentially leading to denial of service, data corruption, or remote code execution when a user opens the compromised file. No evidence of active exploitation in the wild has been reported, but the vulnerability is demonstrable and patch availability is confirmed.
The ujson Python library prior to version 5.12.0 contains an integer overflow/underflow vulnerability in the dumps() function that can crash the Python interpreter (segmentation fault) or cause an infinite loop, leading to denial of service. The vulnerability affects applications that allow untrusted users to control the indent parameter when serializing JSON, or that use large negative indent values with nested data structures. A proof-of-concept demonstrating both the segfault and infinite loop conditions is provided in the vulnerability disclosure, though there is no evidence of active exploitation (not in KEV).
Integer underflow in libexif 0.6.25 and earlier allows local attackers to overwrite memory via crafted MakerNote EXIF data in image files. The flaw occurs when exif_mnote_data_get_value receives a zero-size parameter, triggering a buffer overflow that can lead to arbitrary code execution or information disclosure. No active exploitation confirmed (CISA KEV absent), but upstream commit 7df372e exists. EPSS score of 0.01% suggests low widespread exploitation likelihood, though the high-complexity local attack vector (CVSS AV:L/AC:H) limits real-world risk to scenarios where attackers control image file inputs processed by affected applications.
CVE-2026-3084 is an integer underflow vulnerability in GStreamer's H.266 codec parser that allows remote code execution when processing malicious media files. The vulnerability affects all versions of GStreamer (CPE indicates wildcard versioning) and can be exploited through user interaction with specially crafted H.266 video content, allowing attackers to execute arbitrary code in the context of the application. No active exploitation (not in KEV) or public POC has been reported, and the relatively high CVSS score (7.8) is tempered by the local attack vector and user interaction requirement.
CVE-2026-2921 is an integer overflow vulnerability in GStreamer's RIFF palette handling for AVI files that allows remote code execution with a CVSS score of 7.8. The vulnerability affects all versions of GStreamer (based on CPE wildcard) and requires user interaction to exploit, such as opening a malicious AVI file. No evidence of active exploitation (not in KEV), no public POC mentioned, and EPSS data not provided.
Integer overflow in Rust's Yamux implementation allows unauthenticated remote attackers to crash target nodes by sending specially crafted WindowUpdate frames that trigger arithmetic overflow in stream send-window accounting. An attacker can establish a Yamux session and transmit malicious frames without authentication, causing a panic in the connection state machine and resulting in denial of service. A patch is available to address this high-severity vulnerability.
The ISO-2022-JP encoder in Lexbor before version 2.7.0 contains an integer underflow vulnerability that allows unauthenticated remote attackers to read from stack memory and write to heap memory by crafting malicious DOM tree content. The flaw stems from a failure to reset a size variable between iterations, causing an out-of-bounds memcpy operation with a wrapped SIZE_MAX value. No patch is currently available for affected systems.
Microsoft Office is vulnerable to an integer overflow that allows authenticated local users to escalate their privileges and gain full system control. An attacker with valid credentials can exploit this numeric calculation flaw to execute arbitrary code with elevated permissions. No patch is currently available for this vulnerability.
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. [CVSS 7.5 HIGH]
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could weaken security guarantees.
Integer overflow in TinyWeb before 2.03.
Google Chrome's Skia rendering engine contains an integer overflow flaw that enables remote attackers to access out-of-bounds memory when processing malicious HTML pages. Affected users running Chrome versions prior to 145.0.7632.159 could face memory corruption leading to information disclosure, data modification, or denial of service. A security patch is available to remediate this critical vulnerability.
Google Chrome's ANGLE graphics library before version 145.0.7632.159 contains an integer overflow vulnerability that enables remote attackers to access out-of-bounds memory through malicious HTML pages. An unauthenticated attacker can exploit this flaw by tricking users into visiting a crafted webpage, potentially compromising confidentiality, integrity, and availability. A patch is available in Chrome 145.0.7632.159 and later versions.
Local privilege escalation in Android's mem_protect.c results from integer overflow conditions that enable out-of-bounds memory writes, allowing unauthenticated local attackers to gain elevated system privileges without user interaction. The vulnerability affects multiple functions within the memory protection component and is exploitable by any process on the affected device. A patch is available to address this high-severity issue.
Local privilege escalation in Android's __pkvm_host_share_guest function allows unprivileged attackers to achieve kernel-level code execution through integer overflow-induced out-of-bounds memory writes. The vulnerability requires no user interaction and can be exploited directly from any local context on affected devices. A patch is available to address this high-severity flaw.
Integer overflow in pillow_heif Python library before 1.3.0 leads to out-of-bounds read when processing HEIF images, potentially causing information disclosure or crashes. PoC and patch available.
Integer overflow in NSS (Network Security Services) cryptographic library enables remote unauthenticated attackers to achieve arbitrary code execution with critical impact on confidentiality, integrity, and availability across Mozilla Firefox (<148, ESR <140.8) and Thunderbird (<148, ESR <140.8). The vulnerability carries a maximum CVSS 9.8 score with no exploitation barriers, though EPSS probability remains low (0.04%, 14th percentile) and no active exploitation is confirmed. Vendor patches available through Mozilla security advisories MFSA2026-13/15/16/17 with corresponding Red Hat updates deployed across enterprise distributions.
Integer overflow in Firefox Audio/Video component before 148. Overflow in media processing leads to incorrect memory allocations.
Integer overflow in Firefox JavaScript Standard Library before 148 leads to memory corruption through crafted JavaScript operations.
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts a size_t to int, causing overflow that could compromise cryptographic operations.
Heap corruption in Google Chrome's V8 engine prior to version 145.0.7632.109 can be triggered through integer overflow vulnerabilities when processing malicious HTML pages. An unauthenticated attacker can exploit this by tricking users into visiting a crafted webpage, potentially achieving arbitrary code execution with high impact to confidentiality, integrity, and availability. No patch is currently available for this vulnerability.
Arbitrary code execution in DNG SDK 1.7.1 2410 and earlier stems from an integer overflow vulnerability that executes with user privileges when a victim opens a crafted file. The local attack vector requires user interaction but carries high impact across confidentiality, integrity, and availability with no patch currently available.
Arbitrary code execution in Bridge versions 15.1.3, 16.0.1 and earlier results from an integer overflow vulnerability that executes with user privileges when a victim opens a malicious file. The flaw requires user interaction but carries a high severity rating with no available patch, leaving affected systems vulnerable to immediate compromise.
Arbitrary code execution in Adobe After Effects 25.6 and earlier through an integer overflow vulnerability affecting file processing. An attacker can exploit this by crafting a malicious file that, when opened by a user, executes code with the privileges of the current user. No patch is currently available for this high-severity vulnerability.
Integer overflow in the Bytes library versions 1.2.1 through 1.11.0 allows attackers to corrupt the BytesMut capacity value, leading to out-of-bounds memory access and undefined behavior in release builds. Public exploit code exists for this vulnerability, affecting applications that depend on Bytes for buffer management. A patch is available in version 1.11.1.
Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.
An integer overflow vulnerability in yoyofr modizer before version 4.1.1 allows local attackers with user interaction to achieve high-impact compromise including confidentiality, integrity, and availability violations. The vulnerability requires local access and user interaction to trigger, enabling attackers to execute arbitrary code or cause denial of service through integer wraparound conditions. No patch is currently available for this vulnerability.
IronOS soldering iron firmware has an integer overflow vulnerability that could cause unexpected behavior in temperature control.
Integer overflow in iccDEV's ICC profile parsing (versions 2.3.1.1 and below) allows remote attackers to corrupt memory or trigger denial of service by crafting malicious profile headers with tampered tag tables or offset fields, with public exploit code available. The vulnerability can potentially enable arbitrary code execution or bypass security checks in applications using affected iccDEV libraries. Users should upgrade to version 2.3.1.2 or later to remediate this risk.
ESPHome versions 2025.9.0 through 2025.12.6 are vulnerable to a denial-of-service attack via integer overflow in the API protobuf decoder, affecting all supported microcontroller platforms (ESP32, ESP8266, RP2040, LibreTiny). Unauthenticated attackers can crash ESPHome devices by sending specially crafted packets with large field length values to bypass bounds checking when API encryption is disabled. Upgrade to version 2025.12.7 or later to remediate.
Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.
Arbitrary code execution in Microsoft Office Excel results from an integer underflow vulnerability in the Long Term Servicing Channel and Online Server editions, exploitable by local attackers with user interaction. This HIGH severity flaw (CVSS 7.8) grants full system compromise capabilities including code execution, data theft, and service disruption with no available patch.
Integer overflow in Firefox and Thunderbird's Graphics component enables sandbox escape, allowing remote attackers to execute arbitrary code with high privileges through a malicious webpage or content requiring user interaction. Affected versions include Firefox below 147, Firefox ESR below 115.32 and 140.7, and Thunderbird below 147 and 140.7. No patch is currently available.
iccDEV versions 2.3.1.1 and earlier are vulnerable to use-after-free, heap buffer overflow, and integer overflow flaws in the CIccSparseMatrix function, allowing local attackers with user interaction to achieve arbitrary code execution. The vulnerability affects all systems using vulnerable iccDEV libraries for ICC color profile processing and is resolved in version 2.3.1.2.
Integer overflow in iccDEV's CIccXmlArrayType::ParseTextCountNum() function allows local attackers with user interaction to achieve arbitrary code execution through maliciously crafted ICC color profile files. The vulnerability affects iccDEV versions 2.3.1 and below, impacting users who process untrusted color profiles. Public exploit code exists for this vulnerability, and a patch is available in version 2.3.1.1.
Windows Hyper-V Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windows Graphics Component Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Windows NTFS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 30.0%.
Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 89.0%.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
libheif on Alpine Linux contains a vulnerability addressed in package version 1.23.0-r0. The nature of the flaw - whether memory corruption, input validation failure, or another class - is not disclosed in available intelligence at time of analysis. Alpine Linux vendor advisory confirms a fix exists, but the specific impact, affected component within libheif, and exploitability conditions are not derivable from current data.
Netatalk on Alpine Linux contains an unspecified vulnerability addressed by the Alpine package maintainers in version 4.4.3-r0. The nature of the flaw, affected attack surface, and impact have not been disclosed in the available intelligence - the sole data point is the vendor-issued Alpine Linux package fix. Security teams should treat this as a pending-disclosure patch event and apply the update while awaiting a full CVE write-up.
Integer underflow (CWE-191) in Netatalk, the open-source Apple Filing Protocol (AFP) server, allows a network-authenticated attacker to trigger memory corruption that may result in information disclosure, arbitrary code execution, or denial of service. The vulnerability affects versions prior to 4.4.3 and is patched in Netatalk 4.4.3 (Alpine Linux package 4.4.3-r0). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
Denial of service in PgBouncer 1.21.0 through 1.26.0: a remote attacker who sends a packet header declaring a length above 2^31 triggers an integer overflow in the message buffer growth routine (mbuf_make_room), saturating a CPU core and stalling every pooled connection until the process is restarted. The attack is gated by a non-default configuration - max_packet_size must be set above 2147483648, whereas the shipped default of 2147483647 is not exploitable - but when that setting is in place, versions 1.23.0 through 1.26.0 are reachable before authentication with only a five-byte packet header (PR:N in the assessed vector), while 1.21.0-1.22.x require reaching the vulnerable code path. No public exploit identified at time of analysis, and a vendor patch is available (fixed in 1.26.1 per the EUVD affected-version range).
Denial of service in NASA's F´ (F Prime) flight software framework before version 4.3.0, where an integer-overflow flaw in Svc::FileDownlink's SendPartial range validation lets a caller with command authority over the SendPartial command crash the running flight software process. When an on-board source file is larger than the supplied startOffset and the caller supplies a length whose unsigned 32-bit sum with that offset wraps, the wrapped value passes validation and is stored as m_endOffset while m_byteOffset remains larger, so the first data-packet send hits FW_ASSERT and aborts or resets the process. The issue is authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), availability-only, fixed in 4.3.0; no public exploit identified at time of analysis.
Denial of service in NASA's F´ (F Prime) flight software framework prior to 4.3.0 allows an adjacent, unauthenticated attacker to abort or reset the flight process by issuing a crafted Svc::FileDownlink SendPartial command. The command's startOffset and length are summed in 32-bit arithmetic without an overflow check, so a length that wraps the sum below the size of an existing but larger source file is accepted, storing a wrapped m_endOffset that is inconsistent with m_byteOffset; under standard F Prime assertion handling the first data-packet transition reaches FW_ASSERT and terminates the process. This is an availability-only issue (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no confidentiality or integrity impact), the vendor has released a fix in 4.3.0, and no public exploit was identified at time of analysis.
Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.
Heap memory disclosure and multicast join-state injection in Juniper Junos OS running on EX Series and MX Series platforms, and in Junos OS Evolved on ACX Series, arise from an integer underflow in the rpd routing daemon that can be triggered by an unauthenticated attacker on an adjacent network segment sending a malformed draft-Rosen MVPN message. Only devices that actually support and have draft-Rosen MVPN configured and active are exposed, which bounds the affected population; impact is limited to low-level confidentiality and integrity loss (assessed CVSS 3.1 base 5.3, AV:A/AC:L/PR:N/UI:N/C:L/I:L/A:N) rather than device takeover or denial of service. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so this is a moderate, patch-in-normal-cycle priority rather than an emergency, especially since vendor fixes are already published.
Integer overflow (CWE-190) in the rapidcsv C++ header-only CSV parser prior to version 8.99 allows a local attacker to corrupt heap memory or crash a process that loads an attacker-supplied CSV into an in-memory matrix. The affected APIs - RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames - cast a size_t index to int before adding it to a std::vector iterator, so on 64-bit systems an index above INT_MAX wraps negative and points before the start of the buffer. Exploitation prerequisites are severe: the process must hold a matrix with more than 2^31 elements in a row or column (tens of gigabytes of RAM) and then call one of those APIs, so ordinary CSV workloads are not practically affected. No public exploit identified at time of analysis; the CVSS base score is 2.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and the fix is the vendor-released patch in v8.99.
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
Information disclosure in IBM WebSphere Application Server - Liberty (versions 17.0.0.3 through 26.0.0.9) lets a principal holding only the read-only Reader role send a crafted request to the version-information retrieval path and cause an uncaught exception, rooted in an integer overflow flaw (CWE-190), that exposes version data. Rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the impact is limited to low-sensitivity information disclosure with no stated effect on integrity or availability, and exploitation is not remote-unauthenticated - the attacker must already possess or have compromised a low-privilege authenticated account. No public exploit code and no CISA KEV entry were identified at the time of analysis.
Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
A local attacker can cause a denial of service in device-mapper-persistent-data utilities by supplying crafted device-mapper metadata containing an excessively large block index, which triggers an integer overflow in the synchronous block reading logic and results in a panic that terminates the tool. The attack requires the attacker to place malicious metadata on the host and a victim to invoke the affected utility against it (UI:R), yielding only a low-impact availability loss (CVSS 3.3). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Malformed raw DHCP packets can crash the udhcpc DHCP client shipped in BusyBox, causing denial of service and loss of network connectivity on the affected device until the client restarts or reacquires a lease. The flaw is reachable by any attacker with presence on the same Layer-2 segment as the victim (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5 Medium) and requires no authentication and no user interaction; the assessed impact is availability-only (A:H) with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, and the adjacency requirement sharply limits the attacker population to those already on the local network, Wi-Fi, or VLAN. The first-sentence risk framing is that this is a moderate, availability-only vulnerability whose signals are internally consistent rather than conflicting.
Loading an attacker-supplied DER private-key file into the ConnectBot cbssh SSH client library (sshlib) 0.3.0 and earlier can crash the hosting application process: the DER parser accepts oversized long-form length octets, accumulates them into a 32-bit Int where they wrap around, and then allocates arrays sized by the resulting value without checking it against the remaining input. The reachable entry points are SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), and SshSigning.getPublicKey(); the flaw is not reachable from SSH server host keys or agent-forwarding messages, so a malicious SSH server cannot trigger it. Exploitation is local and requires the victim to deliberately open or supply the malicious key file, and the demonstrated impact is availability only - an uncaught OutOfMemoryError that terminates the process - with no code execution, no confidentiality impact, and no usable weakened key demonstrated; no public exploit code or confirmed in-the-wild exploitation is identified at time of analysis, and vendor-released patch version 0.3.1 resolves it.
Out-of-bounds memory reads in the openUBMC device-management process can be induced by a malicious or compromised device on the internal management bus that returns an undersized PLDM-over-MCTP or NCSI-over-MCTP response. Only environments where an attacker already controls a PLDM endpoint (hitting the base, non-vendor PLDM control class) or a Huawei NIC speaking NCSI-over-MCTP are affected; the bug is not reachable over the network or from a normal host OS, since the CVSS 3.1 vector requires physical/bus access (AV:P, base score 3.5) but no authentication (PR:N). An undersized length wraps an unsigned subtraction, causing the parser to read well past the response buffer, yielding limited information disclosure and a low availability impact; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Integer overflow in AMI AptioV BIOS firmware, classified as CWE-190, can be triggered by a local high-privileged caller to cause buffer overflows, memory corruption, and potential arbitrary code execution with high impact to confidentiality, integrity, and availability. Exploitation requires local access, an existing administrator/root-level foothold (PR:H), and high attack complexity (AC:H) per the assessed vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, so it is not remotely reachable or mass-exploitable. No public exploit was identified at time of analysis, and active exploitation is not confirmed by KEV data; this is a moderate-priority, high-barrier firmware flaw rather than a widespread emergency.
An integer overflow (CWE-190) in Firefox's Layout: Text and Fonts component can be triggered when a user renders attacker-controlled web content containing malformed text or font data, potentially causing memory-safety corruption in the browser process. The vulnerability affects Firefox builds prior to version 158 and Firefox ESR builds prior to 153.5, is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but requires the victim to load the crafted page, and its assessed impact is bounded to low confidentiality and integrity effects with no availability impact (score 5.4). Exploitation is not confirmed in the field: there is no CISA KEV listing and no public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates a low predicted likelihood of exploitation activity.
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).
A remote denial-of-service condition in x64dbg-MCP Server before version 1.2 lets an unauthenticated network client crash the debugger and destroy any active debugging session by sending a crafted HTTP request with a near-maximum Content-Length value. The unbounded value is parsed and then used in an unchecked integer addition inside wsRecv() before the token check runs, so no credentials are required, and pre-1.2 builds bind the listener to 0.0.0.0 by default, making the endpoint broadly reachable. The resulting integer-overflow panic only terminates the process in Debug and ReleaseSafe builds (a ReleaseFast build would not panic), so the impact is limited to loss of availability rather than memory corruption or code execution; there is no confirmed active exploitation and no public exploit code identified at time of analysis.
Opening a specially crafted Microsoft Reader (.lit) ebook in SumatraPDF 3.7.0.22298 terminates the application deterministically: an integer overflow in LitParseHeader() allows a tuned header to compute a negative section offset that is later dereferenced, producing an out-of-bounds read and a crash. Per the authoritative assessment, impact is denial of service only - the supplied evidence demonstrates no code execution, information disclosure, arbitrary read, or integrity impact, despite RCE and Information Disclosure tags appearing alongside this record. Exploitation is not remote or automatable: it requires local delivery of the malicious .lit file and the user actively opening it (CVSS AV:L/UI:R, PR:N), and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Out-of-bounds memory access in the MongoDB C Driver can be induced when an embedding C/C++ application passes a length smaller than the five-byte BSON document minimum to bson_reserve_buffer and then performs an affected append or comparison operation, causing unsigned integer underflow and out-of-bounds access that may terminate the process or read or corrupt adjacent memory. Exploitation is not possible against the library in isolation or default usage: the application must forward an undersized, potentially attacker-influenced length into the reservation call and later exercise an affected operation. No public exploit identified at time of analysis; vendor CVSS 4.0 score is 5.9 with AV:L/AT:P/PR:N, and the independent assessment rates it moderate-severity and condition-dependent.
Denial of service in Dislocker through 0.7.3 is triggered when the tool parses a crafted BitLocker volume image whose VMK or FVEK datum declares a datum_size smaller than the 36-byte AES-CCM header it must contain, causing an integer underflow that yields a near-4GB payload length and sends hexdump() into an out-of-bounds heap read that crashes the process. Exploitation is local and requires user interaction: a victim must actively point dislocker at the attacker-supplied image, which matches the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, unauthenticated but victim-driven. Impact is availability only - there is no memory corruption of confidentiality or integrity consequence described, no public exploit identified at time of analysis, and the defect is not listed as confirmed actively exploited (CISA KEV).
Denial of service in TightVNC Server for Windows before 2.8.88: a local authenticated user can trigger an integer underflow in WinCursorShapeUtils::trimTransparent() by causing a zero-width or zero-height cursor to be processed on the DXGI capture path, crashing the server and potentially causing a limited out-of-bounds memory read. No public exploit identified at time of analysis, and because the vector requires local authenticated access rather than remote reachability, the assessed risk is medium-severity and low real-world priority despite the memory-corruption flavor. The vendor has released a fix in version 2.8.88.
Integer overflow in containerd overlaybd's LSMT index loader (do_load_index) lets a crafted, untrusted overlaybd blob pulled from a registry corrupt heap state and crash the host-side runtime, degrading availability for all overlaybd-backed containers on the node. Affected are overlaybd builds through 1.0.18 that are actually used as the container snapshotter/backend; exploitation is unauthenticated (CVSS PR:N) but requires high attack complexity (AC:H) - the victim must load an attacker-controlled blob in a deployment running multiple overlaybd-backed containers, which is why Scope is Changed. Impact is availability-only (C:N/I:N/A:H, CVSS 6.8); there is no public exploit identified at time of analysis and no CISA KEV confirmation, and organizations pulling only from trusted, signed sources are not realistically exposed.
Opening a crafted workbook with the Excelize Go library (versions 2.1.0 through 2.11.0) triggers an integer-overflow panic that crashes the process, producing a denial of service. A Zip64 entry whose declared uncompressed size falls between 2^63 and 2^64-1 wraps to a negative int64, slips past the library's size-limit checks, and is passed to an allocation as a negative capacity; the crash occurs on the standard open/read path with default options and no credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) reflects that remote attackers can deliver the file but the victim application must be induced to parse it, and that only availability is affected - there is no data exposure or modification, and no public exploit has been identified at time of analysis.
A boundary condition vulnerability combined with an integer overflow flaw exists in the Graphics component of Mozilla Firefox, affecting Firefox versions prior to 149, Firefox ESR versions prior to 115.34, and Firefox ESR versions prior to 140.9. This vulnerability could allow an attacker to trigger a buffer overflow through specially crafted graphics data, potentially leading to memory corruption and arbitrary code execution. While no CVSS score or EPSS data is currently available, the Mozilla security advisories confirm the vulnerability affects multiple product lines across different release channels.
A sandbox escape vulnerability exists in Mozilla Firefox due to incorrect boundary conditions and integer overflow within the XPCOM component, allowing attackers to break out of the browser's security sandbox and potentially execute arbitrary code with elevated privileges. Firefox versions below 149, Firefox ESR below 115.34, and Firefox ESR below 140.9 are affected. An attacker capable of triggering the integer overflow in XPCOM can exploit the boundary condition flaw to escape the sandbox, potentially leading to full system compromise depending on browser privilege level and operating system context.
Integer overflow in the Expat XML parser module within InsightSoftwareConsortium ITK before version 2.7.1 allows remote attackers to cause denial of service or potentially execute arbitrary code through specially crafted XML input. The vulnerability affects all users of vulnerable ITK versions and requires only network access and user interaction to exploit. A patch is available in ITK 2.7.1 and later.
Integer overflow in ART's rtengine dcraw.C module before version 1.25.12 allows local attackers with user interaction to achieve high-impact compromise of confidentiality, integrity, and availability. This vulnerability requires local access and user interaction to trigger, making it exploitable primarily through malicious image files or project files opened by victims.
Unauthenticated remote attackers can crash strongSwan versions 4.5.0 through 6.0.4 via integer underflow in the EAP-TTLS AVP parser during IKEv2 authentication by sending malformed AVP packets with invalid length fields. Public exploit code exists for this denial of service vulnerability, which triggers memory corruption in the charon daemon with no available patch. Organizations running affected strongSwan versions are vulnerable to service disruption without authentication or user interaction required.
The Rust libp2p Gossipsub implementation contains an integer overflow vulnerability that allows remote unauthenticated attackers to crash affected nodes by sending a single crafted PRUNE control message with an extremely large backoff value (e.g., u64::MAX). The vulnerability affects the libp2p-gossipsub Rust crate and enables trivial denial of service against any application exposing a Gossipsub listener. This vulnerability was discovered through responsible disclosure to the Ethereum Foundation bug bounty program by @revofusion, and while no active exploitation (KEV) status is indicated, the attack complexity is extremely low and a detailed proof-of-concept attack scenario has been publicly disclosed in the advisory.
HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain a heap buffer overflow vulnerability in the GZI index loading function `bgzf_index_load_hfile()`. An integer overflow during buffer allocation allows attackers to craft malicious `.gzi` files that trigger heap memory corruption, potentially leading to denial of service, data corruption, or remote code execution when a user opens the compromised file. No evidence of active exploitation in the wild has been reported, but the vulnerability is demonstrable and patch availability is confirmed.
The ujson Python library prior to version 5.12.0 contains an integer overflow/underflow vulnerability in the dumps() function that can crash the Python interpreter (segmentation fault) or cause an infinite loop, leading to denial of service. The vulnerability affects applications that allow untrusted users to control the indent parameter when serializing JSON, or that use large negative indent values with nested data structures. A proof-of-concept demonstrating both the segfault and infinite loop conditions is provided in the vulnerability disclosure, though there is no evidence of active exploitation (not in KEV).
Integer underflow in libexif 0.6.25 and earlier allows local attackers to overwrite memory via crafted MakerNote EXIF data in image files. The flaw occurs when exif_mnote_data_get_value receives a zero-size parameter, triggering a buffer overflow that can lead to arbitrary code execution or information disclosure. No active exploitation confirmed (CISA KEV absent), but upstream commit 7df372e exists. EPSS score of 0.01% suggests low widespread exploitation likelihood, though the high-complexity local attack vector (CVSS AV:L/AC:H) limits real-world risk to scenarios where attackers control image file inputs processed by affected applications.
CVE-2026-3084 is an integer underflow vulnerability in GStreamer's H.266 codec parser that allows remote code execution when processing malicious media files. The vulnerability affects all versions of GStreamer (CPE indicates wildcard versioning) and can be exploited through user interaction with specially crafted H.266 video content, allowing attackers to execute arbitrary code in the context of the application. No active exploitation (not in KEV) or public POC has been reported, and the relatively high CVSS score (7.8) is tempered by the local attack vector and user interaction requirement.
CVE-2026-2921 is an integer overflow vulnerability in GStreamer's RIFF palette handling for AVI files that allows remote code execution with a CVSS score of 7.8. The vulnerability affects all versions of GStreamer (based on CPE wildcard) and requires user interaction to exploit, such as opening a malicious AVI file. No evidence of active exploitation (not in KEV), no public POC mentioned, and EPSS data not provided.
Integer overflow in Rust's Yamux implementation allows unauthenticated remote attackers to crash target nodes by sending specially crafted WindowUpdate frames that trigger arithmetic overflow in stream send-window accounting. An attacker can establish a Yamux session and transmit malicious frames without authentication, causing a panic in the connection state machine and resulting in denial of service. A patch is available to address this high-severity vulnerability.
The ISO-2022-JP encoder in Lexbor before version 2.7.0 contains an integer underflow vulnerability that allows unauthenticated remote attackers to read from stack memory and write to heap memory by crafting malicious DOM tree content. The flaw stems from a failure to reset a size variable between iterations, causing an out-of-bounds memcpy operation with a wrapped SIZE_MAX value. No patch is currently available for affected systems.
Microsoft Office is vulnerable to an integer overflow that allows authenticated local users to escalate their privileges and gain full system control. An attacker with valid credentials can exploit this numeric calculation flaw to execute arbitrary code with elevated permissions. No patch is currently available for this vulnerability.
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. [CVSS 7.5 HIGH]
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could weaken security guarantees.
Integer overflow in TinyWeb before 2.03.
Google Chrome's Skia rendering engine contains an integer overflow flaw that enables remote attackers to access out-of-bounds memory when processing malicious HTML pages. Affected users running Chrome versions prior to 145.0.7632.159 could face memory corruption leading to information disclosure, data modification, or denial of service. A security patch is available to remediate this critical vulnerability.
Google Chrome's ANGLE graphics library before version 145.0.7632.159 contains an integer overflow vulnerability that enables remote attackers to access out-of-bounds memory through malicious HTML pages. An unauthenticated attacker can exploit this flaw by tricking users into visiting a crafted webpage, potentially compromising confidentiality, integrity, and availability. A patch is available in Chrome 145.0.7632.159 and later versions.
Local privilege escalation in Android's mem_protect.c results from integer overflow conditions that enable out-of-bounds memory writes, allowing unauthenticated local attackers to gain elevated system privileges without user interaction. The vulnerability affects multiple functions within the memory protection component and is exploitable by any process on the affected device. A patch is available to address this high-severity issue.
Local privilege escalation in Android's __pkvm_host_share_guest function allows unprivileged attackers to achieve kernel-level code execution through integer overflow-induced out-of-bounds memory writes. The vulnerability requires no user interaction and can be exploited directly from any local context on affected devices. A patch is available to address this high-severity flaw.
Integer overflow in pillow_heif Python library before 1.3.0 leads to out-of-bounds read when processing HEIF images, potentially causing information disclosure or crashes. PoC and patch available.
Integer overflow in NSS (Network Security Services) cryptographic library enables remote unauthenticated attackers to achieve arbitrary code execution with critical impact on confidentiality, integrity, and availability across Mozilla Firefox (<148, ESR <140.8) and Thunderbird (<148, ESR <140.8). The vulnerability carries a maximum CVSS 9.8 score with no exploitation barriers, though EPSS probability remains low (0.04%, 14th percentile) and no active exploitation is confirmed. Vendor patches available through Mozilla security advisories MFSA2026-13/15/16/17 with corresponding Red Hat updates deployed across enterprise distributions.
Integer overflow in Firefox Audio/Video component before 148. Overflow in media processing leads to incorrect memory allocations.
Integer overflow in Firefox JavaScript Standard Library before 148 leads to memory corruption through crafted JavaScript operations.
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts a size_t to int, causing overflow that could compromise cryptographic operations.
Heap corruption in Google Chrome's V8 engine prior to version 145.0.7632.109 can be triggered through integer overflow vulnerabilities when processing malicious HTML pages. An unauthenticated attacker can exploit this by tricking users into visiting a crafted webpage, potentially achieving arbitrary code execution with high impact to confidentiality, integrity, and availability. No patch is currently available for this vulnerability.
Arbitrary code execution in DNG SDK 1.7.1 2410 and earlier stems from an integer overflow vulnerability that executes with user privileges when a victim opens a crafted file. The local attack vector requires user interaction but carries high impact across confidentiality, integrity, and availability with no patch currently available.
Arbitrary code execution in Bridge versions 15.1.3, 16.0.1 and earlier results from an integer overflow vulnerability that executes with user privileges when a victim opens a malicious file. The flaw requires user interaction but carries a high severity rating with no available patch, leaving affected systems vulnerable to immediate compromise.
Arbitrary code execution in Adobe After Effects 25.6 and earlier through an integer overflow vulnerability affecting file processing. An attacker can exploit this by crafting a malicious file that, when opened by a user, executes code with the privileges of the current user. No patch is currently available for this high-severity vulnerability.
Integer overflow in the Bytes library versions 1.2.1 through 1.11.0 allows attackers to corrupt the BytesMut capacity value, leading to out-of-bounds memory access and undefined behavior in release builds. Public exploit code exists for this vulnerability, affecting applications that depend on Bytes for buffer management. A patch is available in version 1.11.1.
Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.
An integer overflow vulnerability in yoyofr modizer before version 4.1.1 allows local attackers with user interaction to achieve high-impact compromise including confidentiality, integrity, and availability violations. The vulnerability requires local access and user interaction to trigger, enabling attackers to execute arbitrary code or cause denial of service through integer wraparound conditions. No patch is currently available for this vulnerability.
IronOS soldering iron firmware has an integer overflow vulnerability that could cause unexpected behavior in temperature control.
Integer overflow in iccDEV's ICC profile parsing (versions 2.3.1.1 and below) allows remote attackers to corrupt memory or trigger denial of service by crafting malicious profile headers with tampered tag tables or offset fields, with public exploit code available. The vulnerability can potentially enable arbitrary code execution or bypass security checks in applications using affected iccDEV libraries. Users should upgrade to version 2.3.1.2 or later to remediate this risk.
ESPHome versions 2025.9.0 through 2025.12.6 are vulnerable to a denial-of-service attack via integer overflow in the API protobuf decoder, affecting all supported microcontroller platforms (ESP32, ESP8266, RP2040, LibreTiny). Unauthenticated attackers can crash ESPHome devices by sending specially crafted packets with large field length values to bypass bounds checking when API encryption is disabled. Upgrade to version 2025.12.7 or later to remediate.
Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.
Arbitrary code execution in Microsoft Office Excel results from an integer underflow vulnerability in the Long Term Servicing Channel and Online Server editions, exploitable by local attackers with user interaction. This HIGH severity flaw (CVSS 7.8) grants full system compromise capabilities including code execution, data theft, and service disruption with no available patch.
Integer overflow in Firefox and Thunderbird's Graphics component enables sandbox escape, allowing remote attackers to execute arbitrary code with high privileges through a malicious webpage or content requiring user interaction. Affected versions include Firefox below 147, Firefox ESR below 115.32 and 140.7, and Thunderbird below 147 and 140.7. No patch is currently available.
iccDEV versions 2.3.1.1 and earlier are vulnerable to use-after-free, heap buffer overflow, and integer overflow flaws in the CIccSparseMatrix function, allowing local attackers with user interaction to achieve arbitrary code execution. The vulnerability affects all systems using vulnerable iccDEV libraries for ICC color profile processing and is resolved in version 2.3.1.2.
Integer overflow in iccDEV's CIccXmlArrayType::ParseTextCountNum() function allows local attackers with user interaction to achieve arbitrary code execution through maliciously crafted ICC color profile files. The vulnerability affects iccDEV versions 2.3.1 and below, impacting users who process untrusted color profiles. Public exploit code exists for this vulnerability, and a patch is available in version 2.3.1.1.
Windows Hyper-V Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windows Graphics Component Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Windows NTFS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 30.0%.
Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 89.0%.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
libheif on Alpine Linux contains a vulnerability addressed in package version 1.23.0-r0. The nature of the flaw - whether memory corruption, input validation failure, or another class - is not disclosed in available intelligence at time of analysis. Alpine Linux vendor advisory confirms a fix exists, but the specific impact, affected component within libheif, and exploitability conditions are not derivable from current data.
Netatalk on Alpine Linux contains an unspecified vulnerability addressed by the Alpine package maintainers in version 4.4.3-r0. The nature of the flaw, affected attack surface, and impact have not been disclosed in the available intelligence - the sole data point is the vendor-issued Alpine Linux package fix. Security teams should treat this as a pending-disclosure patch event and apply the update while awaiting a full CVE write-up.
Integer underflow (CWE-191) in Netatalk, the open-source Apple Filing Protocol (AFP) server, allows a network-authenticated attacker to trigger memory corruption that may result in information disclosure, arbitrary code execution, or denial of service. The vulnerability affects versions prior to 4.4.3 and is patched in Netatalk 4.4.3 (Alpine Linux package 4.4.3-r0). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
Denial of service in PgBouncer 1.21.0 through 1.26.0: a remote attacker who sends a packet header declaring a length above 2^31 triggers an integer overflow in the message buffer growth routine (mbuf_make_room), saturating a CPU core and stalling every pooled connection until the process is restarted. The attack is gated by a non-default configuration - max_packet_size must be set above 2147483648, whereas the shipped default of 2147483647 is not exploitable - but when that setting is in place, versions 1.23.0 through 1.26.0 are reachable before authentication with only a five-byte packet header (PR:N in the assessed vector), while 1.21.0-1.22.x require reaching the vulnerable code path. No public exploit identified at time of analysis, and a vendor patch is available (fixed in 1.26.1 per the EUVD affected-version range).
Denial of service in NASA's F´ (F Prime) flight software framework before version 4.3.0, where an integer-overflow flaw in Svc::FileDownlink's SendPartial range validation lets a caller with command authority over the SendPartial command crash the running flight software process. When an on-board source file is larger than the supplied startOffset and the caller supplies a length whose unsigned 32-bit sum with that offset wraps, the wrapped value passes validation and is stored as m_endOffset while m_byteOffset remains larger, so the first data-packet send hits FW_ASSERT and aborts or resets the process. The issue is authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), availability-only, fixed in 4.3.0; no public exploit identified at time of analysis.
Denial of service in NASA's F´ (F Prime) flight software framework prior to 4.3.0 allows an adjacent, unauthenticated attacker to abort or reset the flight process by issuing a crafted Svc::FileDownlink SendPartial command. The command's startOffset and length are summed in 32-bit arithmetic without an overflow check, so a length that wraps the sum below the size of an existing but larger source file is accepted, storing a wrapped m_endOffset that is inconsistent with m_byteOffset; under standard F Prime assertion handling the first data-packet transition reaches FW_ASSERT and terminates the process. This is an availability-only issue (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no confidentiality or integrity impact), the vendor has released a fix in 4.3.0, and no public exploit was identified at time of analysis.
Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.
Heap memory disclosure and multicast join-state injection in Juniper Junos OS running on EX Series and MX Series platforms, and in Junos OS Evolved on ACX Series, arise from an integer underflow in the rpd routing daemon that can be triggered by an unauthenticated attacker on an adjacent network segment sending a malformed draft-Rosen MVPN message. Only devices that actually support and have draft-Rosen MVPN configured and active are exposed, which bounds the affected population; impact is limited to low-level confidentiality and integrity loss (assessed CVSS 3.1 base 5.3, AV:A/AC:L/PR:N/UI:N/C:L/I:L/A:N) rather than device takeover or denial of service. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so this is a moderate, patch-in-normal-cycle priority rather than an emergency, especially since vendor fixes are already published.
Integer overflow (CWE-190) in the rapidcsv C++ header-only CSV parser prior to version 8.99 allows a local attacker to corrupt heap memory or crash a process that loads an attacker-supplied CSV into an in-memory matrix. The affected APIs - RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames - cast a size_t index to int before adding it to a std::vector iterator, so on 64-bit systems an index above INT_MAX wraps negative and points before the start of the buffer. Exploitation prerequisites are severe: the process must hold a matrix with more than 2^31 elements in a row or column (tens of gigabytes of RAM) and then call one of those APIs, so ordinary CSV workloads are not practically affected. No public exploit identified at time of analysis; the CVSS base score is 2.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and the fix is the vendor-released patch in v8.99.
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
Information disclosure in IBM WebSphere Application Server - Liberty (versions 17.0.0.3 through 26.0.0.9) lets a principal holding only the read-only Reader role send a crafted request to the version-information retrieval path and cause an uncaught exception, rooted in an integer overflow flaw (CWE-190), that exposes version data. Rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the impact is limited to low-sensitivity information disclosure with no stated effect on integrity or availability, and exploitation is not remote-unauthenticated - the attacker must already possess or have compromised a low-privilege authenticated account. No public exploit code and no CISA KEV entry were identified at the time of analysis.
Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
A local attacker can cause a denial of service in device-mapper-persistent-data utilities by supplying crafted device-mapper metadata containing an excessively large block index, which triggers an integer overflow in the synchronous block reading logic and results in a panic that terminates the tool. The attack requires the attacker to place malicious metadata on the host and a victim to invoke the affected utility against it (UI:R), yielding only a low-impact availability loss (CVSS 3.3). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Malformed raw DHCP packets can crash the udhcpc DHCP client shipped in BusyBox, causing denial of service and loss of network connectivity on the affected device until the client restarts or reacquires a lease. The flaw is reachable by any attacker with presence on the same Layer-2 segment as the victim (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5 Medium) and requires no authentication and no user interaction; the assessed impact is availability-only (A:H) with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, and the adjacency requirement sharply limits the attacker population to those already on the local network, Wi-Fi, or VLAN. The first-sentence risk framing is that this is a moderate, availability-only vulnerability whose signals are internally consistent rather than conflicting.
Loading an attacker-supplied DER private-key file into the ConnectBot cbssh SSH client library (sshlib) 0.3.0 and earlier can crash the hosting application process: the DER parser accepts oversized long-form length octets, accumulates them into a 32-bit Int where they wrap around, and then allocates arrays sized by the resulting value without checking it against the remaining input. The reachable entry points are SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), and SshSigning.getPublicKey(); the flaw is not reachable from SSH server host keys or agent-forwarding messages, so a malicious SSH server cannot trigger it. Exploitation is local and requires the victim to deliberately open or supply the malicious key file, and the demonstrated impact is availability only - an uncaught OutOfMemoryError that terminates the process - with no code execution, no confidentiality impact, and no usable weakened key demonstrated; no public exploit code or confirmed in-the-wild exploitation is identified at time of analysis, and vendor-released patch version 0.3.1 resolves it.
Out-of-bounds memory reads in the openUBMC device-management process can be induced by a malicious or compromised device on the internal management bus that returns an undersized PLDM-over-MCTP or NCSI-over-MCTP response. Only environments where an attacker already controls a PLDM endpoint (hitting the base, non-vendor PLDM control class) or a Huawei NIC speaking NCSI-over-MCTP are affected; the bug is not reachable over the network or from a normal host OS, since the CVSS 3.1 vector requires physical/bus access (AV:P, base score 3.5) but no authentication (PR:N). An undersized length wraps an unsigned subtraction, causing the parser to read well past the response buffer, yielding limited information disclosure and a low availability impact; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Integer overflow in AMI AptioV BIOS firmware, classified as CWE-190, can be triggered by a local high-privileged caller to cause buffer overflows, memory corruption, and potential arbitrary code execution with high impact to confidentiality, integrity, and availability. Exploitation requires local access, an existing administrator/root-level foothold (PR:H), and high attack complexity (AC:H) per the assessed vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, so it is not remotely reachable or mass-exploitable. No public exploit was identified at time of analysis, and active exploitation is not confirmed by KEV data; this is a moderate-priority, high-barrier firmware flaw rather than a widespread emergency.
An integer overflow (CWE-190) in Firefox's Layout: Text and Fonts component can be triggered when a user renders attacker-controlled web content containing malformed text or font data, potentially causing memory-safety corruption in the browser process. The vulnerability affects Firefox builds prior to version 158 and Firefox ESR builds prior to 153.5, is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but requires the victim to load the crafted page, and its assessed impact is bounded to low confidentiality and integrity effects with no availability impact (score 5.4). Exploitation is not confirmed in the field: there is no CISA KEV listing and no public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates a low predicted likelihood of exploitation activity.
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).
A remote denial-of-service condition in x64dbg-MCP Server before version 1.2 lets an unauthenticated network client crash the debugger and destroy any active debugging session by sending a crafted HTTP request with a near-maximum Content-Length value. The unbounded value is parsed and then used in an unchecked integer addition inside wsRecv() before the token check runs, so no credentials are required, and pre-1.2 builds bind the listener to 0.0.0.0 by default, making the endpoint broadly reachable. The resulting integer-overflow panic only terminates the process in Debug and ReleaseSafe builds (a ReleaseFast build would not panic), so the impact is limited to loss of availability rather than memory corruption or code execution; there is no confirmed active exploitation and no public exploit code identified at time of analysis.
Opening a specially crafted Microsoft Reader (.lit) ebook in SumatraPDF 3.7.0.22298 terminates the application deterministically: an integer overflow in LitParseHeader() allows a tuned header to compute a negative section offset that is later dereferenced, producing an out-of-bounds read and a crash. Per the authoritative assessment, impact is denial of service only - the supplied evidence demonstrates no code execution, information disclosure, arbitrary read, or integrity impact, despite RCE and Information Disclosure tags appearing alongside this record. Exploitation is not remote or automatable: it requires local delivery of the malicious .lit file and the user actively opening it (CVSS AV:L/UI:R, PR:N), and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Out-of-bounds memory access in the MongoDB C Driver can be induced when an embedding C/C++ application passes a length smaller than the five-byte BSON document minimum to bson_reserve_buffer and then performs an affected append or comparison operation, causing unsigned integer underflow and out-of-bounds access that may terminate the process or read or corrupt adjacent memory. Exploitation is not possible against the library in isolation or default usage: the application must forward an undersized, potentially attacker-influenced length into the reservation call and later exercise an affected operation. No public exploit identified at time of analysis; vendor CVSS 4.0 score is 5.9 with AV:L/AT:P/PR:N, and the independent assessment rates it moderate-severity and condition-dependent.
Denial of service in Dislocker through 0.7.3 is triggered when the tool parses a crafted BitLocker volume image whose VMK or FVEK datum declares a datum_size smaller than the 36-byte AES-CCM header it must contain, causing an integer underflow that yields a near-4GB payload length and sends hexdump() into an out-of-bounds heap read that crashes the process. Exploitation is local and requires user interaction: a victim must actively point dislocker at the attacker-supplied image, which matches the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, unauthenticated but victim-driven. Impact is availability only - there is no memory corruption of confidentiality or integrity consequence described, no public exploit identified at time of analysis, and the defect is not listed as confirmed actively exploited (CISA KEV).
Denial of service in TightVNC Server for Windows before 2.8.88: a local authenticated user can trigger an integer underflow in WinCursorShapeUtils::trimTransparent() by causing a zero-width or zero-height cursor to be processed on the DXGI capture path, crashing the server and potentially causing a limited out-of-bounds memory read. No public exploit identified at time of analysis, and because the vector requires local authenticated access rather than remote reachability, the assessed risk is medium-severity and low real-world priority despite the memory-corruption flavor. The vendor has released a fix in version 2.8.88.
Integer overflow in containerd overlaybd's LSMT index loader (do_load_index) lets a crafted, untrusted overlaybd blob pulled from a registry corrupt heap state and crash the host-side runtime, degrading availability for all overlaybd-backed containers on the node. Affected are overlaybd builds through 1.0.18 that are actually used as the container snapshotter/backend; exploitation is unauthenticated (CVSS PR:N) but requires high attack complexity (AC:H) - the victim must load an attacker-controlled blob in a deployment running multiple overlaybd-backed containers, which is why Scope is Changed. Impact is availability-only (C:N/I:N/A:H, CVSS 6.8); there is no public exploit identified at time of analysis and no CISA KEV confirmation, and organizations pulling only from trusted, signed sources are not realistically exposed.
Opening a crafted workbook with the Excelize Go library (versions 2.1.0 through 2.11.0) triggers an integer-overflow panic that crashes the process, producing a denial of service. A Zip64 entry whose declared uncompressed size falls between 2^63 and 2^64-1 wraps to a negative int64, slips past the library's size-limit checks, and is passed to an allocation as a negative capacity; the crash occurs on the standard open/read path with default options and no credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) reflects that remote attackers can deliver the file but the victim application must be induced to parse it, and that only availability is affected - there is no data exposure or modification, and no public exploit has been identified at time of analysis.