Integer Overflow
Monthly
Integer overflow in ImageMagick's pixel-cache allocation path (GetVirtualPixels / SetPixelCacheNexusPixels) lets a locally supplied crafted call with attacker-controlled width, height, and channel/metacontent values overflow MagickSizeType arithmetic and write past a heap buffer, crashing the affected process. All ImageMagick releases prior to 6.9.13-56 (6.x line) and 7.1.2-31 (7.x line) are affected; the assessed CVSS is 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning impact is confined to a denial of service with no confidentiality or integrity loss and no demonstrated code execution. Exploitation is local and high-complexity because a precise overflow condition must be induced; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided in the available intelligence. Vendor-released patches exist in 6.9.13-56 and 7.1.2-31.
An authenticated remote attacker with a valid SSH session can trigger a one-byte out-of-bounds stack write in wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms by sending a crafted SFTP path, which can corrupt an adjacent stack value and crash the server process. The flaw is an unsigned integer underflow (CWE-191) in which the pointer/length math in wolfSSH_RealPath() and wstrncat() wraps once the accumulated path reaches roughly half the output buffer, causing a terminating null byte to be written one byte past the end of the stack buffer. The impact is limited to a single-byte corruption causing denial of service rather than arbitrary write or code execution, and no public exploit has been identified at time of analysis; a separate, more severe unbounded-copy condition exists only for third-party applications that call the public wolfSSH_RealPath() API with an output buffer smaller than the input path.
Integer overflow leading to a heap-based buffer overflow in GIMP's DICOM export plug-in allows a local user to corrupt memory when exporting an image whose width and height are large enough that the 32-bit width × height × bytes-per-pixel product wraps and undersizes the heap allocation. Exploitation requires the victim to initiate the export and involves a crafted image with extremely large dimensions, so the attack is local (AV:L) and user-interaction dependent (UI:R), with high attack complexity (AC:H); the assessed CVSS is 6.3 with high integrity and availability impact but no confidentiality impact. No public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV), and no vendor-released patch version is identified in the available data.
Cross-origin data disclosure in Google Chrome desktop (Compositing component) affects builds prior to 155.0.8059.39, where a remote attacker can use a crafted HTML page to exploit an integer overflow and read limited data belonging to another origin. Exploitation is not passive: per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) the victim must load the attacker-controlled page, so a malicious-site, malvertising, or social-engineering delivery is required, and the impact is confined to low-confidentiality leakage with no integrity or availability effect. No public exploit code has been identified at time of analysis - this is not on CISA KEV - and the vendor patch is already available, meaning the effective window is mostly determined by how quickly browsers auto-update; despite the 'High' Chromium internal severity label, this is a moderate-severity, low-real-risk issue.
Heap corruption in GNU Aspell's personal-wordlist handling lets a local attacker crash a user's spell-checking session by supplying a crafted dictionary file. All Aspell releases before 0.60.8.3 are affected: when a wordlist containing a word whose length is an exact multiple of 256 bytes is loaded, WritableDict::add() in modules/speller/default/writable.cpp stores the word length in a single byte, truncating it and corrupting heap memory, which results in denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor fix was published as commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and is slated for release in version 0.60.8.3. With a CVSS 4.0 base score of 1.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, this is a genuinely low-priority issue: the attack is local-only, needs the victim to actively load an attacker-supplied dictionary, requires the specific multiple-of-256 length condition, and yields availability loss only.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Cross-origin data leakage in Google Chrome versions prior to 154.0.8037.97 stems from an integer overflow in the Skia 2D graphics engine that a remote attacker can trigger by convincing a victim to load a crafted HTML page, allowing data belonging to other origins to be read. The flaw is remotely reachable by unauthenticated attackers per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N), but it mandates user interaction (UI:R) and carries only low confidentiality impact with no integrity or availability effect, for an overall CVSS of 4.3. EPSS is just 0.17% (6th percentile) and there is no public exploit identified at time of analysis, while Chromium's own 'High' severity label reflects the impact class rather than demonstrated exploitability; a vendor patch is available in Chrome 154.0.8037.97.
Integer overflow in Google Chrome's Compositing component affects all builds prior to 154.0.8037.97 and allows remote attackers to leak cross-origin data when a victim navigates to a crafted HTML page (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw is unauthenticated from a network perspective but requires user interaction - the victim must actively load attacker-controlled content - and it is confined to confidentiality impact, with no integrity or availability effect; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. EPSS probability is low at 0.18% (6th percentile) and CISA's SSVC rates exploitation as none and automatable as no, so this is a moderate-priority patch rather than an emergency one.
An integer overflow in the blosclz decompression path of C-Blosc2 3.3.2 and earlier allows a remote attacker who can supply crafted compressed data to a program that calls blosclz_decompress to corrupt an output-buffer bounds computation, potentially causing memory corruption. Successful exploitation depends entirely on a consuming application accepting and decompressing attacker-influenced Blosc2/blosclz data, and the vendor characterizes the attack as high complexity and difficult; per the CVSS 4.0 vector the impact is Low across confidentiality, integrity, and availability and no privileges or user interaction are required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is assessed as a real but low-priority memory-safety defect; the vendor-released fix is version 3.3.3.
Integer overflow in the image-encoding routines of nothings/stb (stb_image_write.h, stb through version 1.16) allows remote attackers who can influence image dimensions or channel counts passed to stbi_write_png_to_mem, stbi_write_jpg_core, or stbi_write_tga_core to corrupt memory or crash the encoding process. Publicly available exploit code exists (no CISA KEV entry, so active exploitation is not confirmed), and the flaw requires an application that feeds attacker-controlled sizing into the encoder rather than simple network reachability. The published CVSS 4.0 score of 6.9 overstates practical risk: an independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N with only low integrity and availability impact and no confidentiality impact - a genuine but modest-severity issue whose real exposure depends entirely on whether the host application passes untrusted dimensions to the write functions.
Integer overflow in the hexwave_init() function of Nothings stb (stb_hexwave.h) corrupts allocation sizing when an application passes attacker-influenced width or oversample arguments during wave-table initialization. Exploitation is remote and unauthenticated at the library level and publicly available exploit code exists (no confirmed active exploitation), but the practical attack surface is limited: these are initialization parameters normally hardcoded by the developer, so exploitation requires an application that surfaces them to untrusted input. Impact is bounded to low integrity and availability loss, consistent with memory corruption or a crash rather than reliable code execution, and the project has not responded to the issue report, leaving no confirmed vendor patch.
Signed integer overflow in the Splash rasterization backend of Freedesktop Poppler (SplashClip::clipToPath in splash/SplashClip.cc) lets a local attacker crash or destabilize any Poppler-backed application that renders an attacker-crafted PDF, yielding a denial-of-service primitive with no confidentiality or integrity impact. Versions up to and including 26.08.0 are affected, publicly available exploit code exists (no KEV listing, so this is not confirmed active exploitation), and the flaw is fixed in 26.09.0. Exploitation is local in nature and requires the victim to open or render the malicious document, so despite the alarming CWE-190 integer-overflow class the realistic risk is low and availability-only.
Heap under-allocation in U-Boot's SquashFS directory-table parser (fs/squashfs/sqfs.c) allows an attacker who supplies a crafted SquashFS filesystem image to trigger out-of-bounds heap writes and crash the bootloader, producing a denial of service during or after boot. All U-Boot releases before 2026.10-rc4 that are compiled with SquashFS support are affected, and exploitation requires the device to read and parse an attacker-controlled image from boot media, which is why the vendor treats this as a physical/local-vector issue (CVSS 4.0 base 5.2; the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). No public exploit code has been identified at time of analysis, and the flaw was reported by VulnCheck alongside a vendor fix commit.
A signed integer overflow (CWE-190) in Poppler's TrueType font conversion path, specifically FoFiTrueType::cvtSfnts in fofi/FoFiTrueType.cc, lets an attacker who supplies a crafted sfnt/TrueType font - typically embedded inside a PDF that is rendered or converted with tools such as pdftops - corrupt the handling of font table lengths during conversion. The defect affects Poppler 26.06.0, 26.07.0 and 26.08.0 and is reachable only locally, when a victim or local process opens or converts the malicious file; the assessed impact is bounded to limited integrity loss (VI:L) with no confidentiality or availability impact, so this is not a straightforward remote code execution issue. Publicly available exploit code exists and has been disclosed alongside a signed-overflow write-up in a public GitHub repository, and upstream has published a fix as commit 245d3c6823377755f2c1d5fdddd010279c6ed94d (merge request !2326); despite the public PoC, the CVSS v4.0 score of 4.8 and the vendor vector (AV:L/PR:L, VI:L, E:P) keep this a low-priority issue for most deployments.
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage handling by supplying a crafted 'pct=' value in a DMARC DNS TXT record. Publicly available exploit code exists, but the vulnerability is not confirmed actively exploited (CISA KEV). Exploitation requires the target to be actively performing DMARC verification on inbound mail and the attacker to control a queried domain's DMARC record; assessed impact is limited to integrity of policy-percentage handling and minor availability disruption, not RCE or data disclosure.
Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.
CVE-2025-14181 currently has no usable detail: the record contains no description, no CVSS score, no CVSS vector, and no CWE, and the only supplied attribution is the vendor source "ubuntu". Because the affected component, the impact class, and the attack vector are all undefined, it is not possible to state who is affected beyond the Ubuntu distribution packaging channel, nor what an attacker could achieve; authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis and no CISA KEV entry is present. Risk cannot be meaningfully assessed from the available data, so this identifier should be triaged as unresolved rather than as a confirmed threat until the Ubuntu security advisory and NVD entry are populated.
Denial of service in Bento4 1.6.0.0 arises when the MP4 parser processes a crafted H.264/AVC or H.265/HEVC configuration atom (avcC or hvcC) whose declared atom size is smaller than AP4_ATOM_HEADER_SIZE. The size calculation underflows, AP4_AvccAtom::Create() or AP4_HvccAtom::Create() then passes an invalid or NULL pointer into the AP4_DataBuffer copy path, and the hosting application terminates. The CVSS vector is AV:L/PR:N/UI:N with only availability impact, so exploitation requires the malicious file to reach a local parsing path; no public exploit identified at time of analysis, CISA KEV status is not indicated in the supplied data, and EPSS is 0.15% (3rd percentile).
CVE-2026-6103 is an as-yet uncharacterized security issue in software distributed and maintained through Ubuntu, reported to this pipeline solely by the Ubuntu vendor feed with no accompanying description, CVSS vector, or CWE classification. Because the report carries no affected package name, no version range, and no attack-vector metadata, it is not possible to state who is affected beyond Ubuntu users of whatever component the Ubuntu Security Tracker assigns to this CVE, or what an attacker could achieve. No public exploit identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied; risk cannot be meaningfully assessed from the available data until the Ubuntu Security Tracker entry (and the corresponding NVD record) is retrieved.
Integer overflow in the ALSA topology decoder of alsa-lib through 1.2.16.1 lets a crafted .tplg topology file wrap the combined control-element size calculation, so the decoder passes its bounds check and reads past the end of the topology buffer, potentially disclosing process memory or crashing the application. Exploitation is local (AV:L) and requires the victim to load an attacker-supplied topology file (UI:P/UI:R, PR:N); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Independent assessment rates the real-world risk as low-to-moderate: topology files are normally trusted, system-provided sound-card configuration data, so the flaw is only practically reachable where alsa-lib processes topology input from an untrusted source, and the demonstrated impact is limited to low confidentiality and low availability loss.
Parsing a crafted PE file with a malformed IMAGE_BASE_RELOCATION BlockSize field can crash or disrupt JusticeRage Manalyze 1.0.0 through an integer underflow in PE::_parse_relocations, a low-severity denial-of-service condition confined to the analysis tool itself. The attack is local only: the victim must run Manalyze (manually as a malware analyst, or automatically in a triage/sandbox pipeline) against the attacker-supplied sample, and there is no code execution, confidentiality loss, or integrity loss - only the parsing routine misbehaves. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the upstream commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 adds the missing BlockSize validation; the EPSS signal for this niche tooling bug is consistent with a low real-world priority.
Risk for CVE-2026-95308 cannot be meaningfully assessed from the intelligence supplied: the record carries no description, no CVSS score or vector, no CWE, and no CPE or package identifiers, and the sole source attribution is the Ubuntu security team. This indicates an issue tracked against some package within the Ubuntu/Debian ecosystem, but the affected component, the required privilege level, and whether user interaction or a non-default configuration is necessary all remain unconfirmed. No public exploit code has been identified at time of analysis, and there is no KEV listing, so there is currently no signal of active exploitation. The actionable next step is to obtain the corresponding Ubuntu Security Notice (USN) for CVE-2026-95308, which will establish the real exploitation conditions and severity.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
An authenticated Netdata child agent can crash its parent agent by streaming an oversized DIMENSION SLOT value in the plugins.d protocol, triggering an integer overflow that leads to a heap out-of-bounds write and termination of the parent process. Affected deployments are Netdata parent-child streaming setups running versions prior to 2.10.4 (including nightly builds earlier than 2.10.0-782-nightly); the attacker must already control or have compromised a child agent that is authenticated to the parent, so exploitation is limited to denial of service with no confidentiality or integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is moderate rather than urgent, and it is fully closed by upgrading to the fixed release.
Heap memory corruption and denial of service in radare2 versions prior to 6.2.0 occur when the CPython .pyc marshal parser processes a crafted bytecode file that declares a string length of 0xffffffff, wrapping the size-plus-one allocation to zero before attacker-controlled data and fill bytes are written past the heap buffer. Exploitation is local and requires user interaction - an analyst must open or inspect the malicious .pyc with r2 or rabin2 - and no privileges are needed per the CVSS vector (AV:L/PR:N/UI:R), with impact confined to corrupting or crashing the analysis process. Arbitrary code execution is possible in principle but has not been demonstrated, no public exploit code has been identified at time of analysis, and the 5.5 CVSS score reflects a genuinely low-priority issue for most environments. Only workflows that routinely open untrusted .pyc files (malware analysis, CTF, reverse-engineering) are realistically at risk.
Out-of-bounds read in the XS encoder of Perl's Net::IDN::Punycode (all versions before 2.590) lets a remote attacker who can influence a string passed to encode_punycode push a single byte from outside the module's 36-entry punycode digit table into the encoded result, or crash the calling process. The flaw is a signed-integer overflow of the punycode delta accumulator in the compiled XS backend; the pure-Perl PP backend is not affected, so exposure is limited to applications that have the XS module installed and feed it attacker-controlled labels, such as IDN/domain-to-ASCII conversion pipelines. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), impact is bounded to a one-byte information leak or a denial-of-service crash with no code execution or integrity impact, and no public exploit code has been identified at time of analysis; the vendor has shipped a fix in 2.590.
Integer overflow in MPack 1.1.1's mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() helpers causes the allocation size computation (node.data->len + 1) to wrap to zero when a parsed MessagePack node advertises a length of SIZE_MAX, yielding an undersized buffer allocation and, in the officially scored path, a denial-of-service/crash. Exploitation requires the consuming application to use MPack's node/tree reader API and to call one of these helpers on a node whose length is attacker-controlled; it is realistically reachable on 32-bit platforms where SIZE_MAX equals UINT32_MAX (~4 GB) and generally infeasible on 64-bit platforms. The assessed vector is local (AV:L) with high attack complexity (AC:H) and no authentication or user interaction requirement (PR:N/UI:N), so remote reachability depends entirely on whether the host application exposes the parser to untrusted network input; there is no public exploit identified at time of analysis and EPSS is low at 0.20% (10th percentile).
A crafted bulk-insert payload triggers an integer overflow in FalkorDB's _BulkInsert_ReadProperty parser (/bulk_insert.c), crashing the module and taking down the Redis process that hosts it, for a denial-of-service condition in v4.20.1. The assessed CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) means remote, unauthenticated, no-interaction exploitation with availability-only impact; in practice the effective bar depends on whether the Redis deployment enforces requirepass or ACL authentication, which would raise the requirement to valid credentials. No public exploit code identified at time of analysis, no CISA KEV listing, and the sole reference is the vendor GitHub issue FalkorDB/FalkorDB#2326 - consistent with an independent assessment of a moderate-severity, availability-only issue of low real-world priority.
Integer underflow in the PE parser of Manalyze 1.0.0 (PE::_parse_debug in manape/pe.cpp) can be triggered when the tool processes a crafted Portable Executable whose IMAGE_DEBUG_MISC debug-directory entry declares a Length smaller than the misc structure header, causing the computed string length to wrap to a very large unsigned value and the parser to read beyond the intended buffer. Exploitation is not remote in practice: it requires a local user (typically a malware analyst) to voluntarily run the unpatched Manalyze CLI against the malicious sample, so the assessed risk is low (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), with impact largely confined to the parsing process - the tag 'Information Disclosure' reflects the out-of-bounds read potential rather than confirmed data exfiltration. No public exploit code and no active exploitation have been identified at time of analysis, and an upstream fix commit (3e299685759f4f767088871de58c5d07f98ee382) is available.
Signed 32-bit integer overflow in SerenityOS LibGfx's BMP decoder can crash the decoder when a victim opens a crafted BMP whose height field is INT32_MIN, affecting BMPLoader.cpp's decode_bmp_pixel_data and related DIB parsing. Publicly available exploit code exists, but exploitation requires user interaction and high complexity, and the realistic impact is minor availability loss only, with no code execution or data disclosure demonstrated. The CVSS 4.0 score of 2.3 and the independent assessment agree this is a low-priority issue.
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application that parses an attacker-supplied SoundFont 2 file. The SF2 parser derives the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without first rejecting chunks smaller than a single record, so a zero-sized DMOD chunk underflows the unsigned subtraction to UINT_MAX and the loader attempts to allocate billions of SFMod structures until process memory is exhausted. Rated CVSS 6.2 (AV:L/AC:L/PR:N/UI:N, availability-only), the issue requires only that a crafted .sf2 file be loaded locally (no privileges and no user interaction beyond opening the file), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-released patch is version 2.5.6.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-size check, triggering an approximately 4 GB pool-cue allocation and billions of out-of-bounds reads that crash the process, producing a denial of service against the affected 2.5.0 through 2.5.5 releases. Exploitation requires the library to be built with enable-native-dls=ON and an attacker-supplied DLS file to be opened by the application; the CVSS vector indicates no privileges are required (PR:N), and no public exploit code was identified at time of analysis. The vendor has fixed the flaw in FluidSynth 2.5.6.
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted DLS SoundFont file: an integer overflow in the parser's articulation-chunk size check lets the loader run roughly a billion out-of-bounds 12-byte iterations, causing a crash or hang. The flaw affects versions 2.5.0 through 2.5.5 and is fixed in 2.5.6; exploitation requires the target to be built with the non-default CMake option enable-native-dls set to ON and to load the attacker-supplied file (unauthenticated per the CVSS PR:N vector, but the attack vector is local and the malicious file must reach the application). No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - there is no code execution or data disclosure.
An integer-overflow flaw in libheif's RGB-to-YCbCr conversion path (libheif/color-conversion/rgb2yuv.cc) can crash an application that encodes extremely large RGB images constructed via heif_image_create() and heif_image_add_plane() before calling heif_context_encode_image(); a 32-bit stride field wraps, so the conversion loop computes an invalid input pointer and reads past the end of the allocated interleaved plane. Affected deployments are those running libheif versions prior to 1.19.6 that expose the ENCODE path to caller- or attacker-influenced image dimensions - pure decode/parsing workflows are not affected. Impact is limited to process termination (no code execution, no data disclosure), and no public exploit code was identified at time of analysis.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
Rendering a crafted PDF with Freedesktop Poppler 26.07.0 can trigger a signed integer overflow in the TrueType font handler FoFiTrueType::mapCodeToGID when an embedded font supplies a manipulated segCnt value, producing a crash or a bounded out-of-bounds read rather than confirmed code execution. The flaw is remotely reachable with no authentication (CVSS 4.0 PR:N, CVSS 3.1 PR:N) but requires the victim or an automated pipeline to open or convert the attacker-supplied document (UI:P/UI:R), so it is not a hands-off network exploit; publicly available exploit code exists but there is no indication of confirmed active exploitation (no CISA KEV listing). With a base score of 5.3 and C:L/I:L/A:L on the assessed 3.1 vector, this is a moderate, opportunistic-risk issue rather than a top-tier priority, and it matters most to environments that automatically render or convert untrusted PDFs at scale.
Integer overflow in the JBIG2 code-table parser (JBIG2Stream::readCodeTableSeg) of Freedesktop Poppler 26.07.0 allows a remote attacker to crash or destabilize the rendering process by supplying a crafted PDF that embeds a malicious JBIG2 image stream. The flaw is reachable without authentication, but requires the victim to open the document or have a batch tool such as pdftoppm or pdfimages process it, and the independent assessment limits realistic impact to denial of service (integrity and confidentiality are unaffected). Publicly available exploit code exists (a write-up and PoC linked from the CVE references), and the CISA KEV catalog does not list this CVE, so it is a low-to-moderate, non-urgent memory-safety issue rather than a confirmed actively exploited threat.
Integer overflow in Freedesktop Poppler 26.07.0's SampledFunction::SampledFunction (poppler/Function.cc) allows unauthenticated remote attackers to crash PDF-rendering applications by supplying a crafted PDF with an oversized BitsPerSample value, resulting in an availability-only denial of service. Exploitation requires a victim to open or render the malicious file (UI:P/UI:R), and publicly available exploit code exists; the issue is not confirmed as actively exploited in CISA KEV. With a CVSS 4.0 base score of 2.1 and an independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, the risk is low and confined to availability with no demonstrated confidentiality or integrity impact.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
A heap-based buffer overflow in the Samsung Escargot JavaScript engine is reachable when a crafted bytecode-cache file is parsed, driven by an integer wraparound (CWE-190) in the string-table length handling inside CodeCacheReader::loadStringTable. Exploitation requires local write access to the engine's bytecode-cache directory (CVSS 5.5, AV:L/PR:L), and the impact is limited to availability - a crash or memory-corruption-induced denial of service with no confidentiality or integrity loss. No public exploit code or CISA KEV listing was identified at time of analysis, and the upstream fix (Samsung PR #1650) adds a bounds check rejecting any maxLength above STRING_MAXIMUM_LENGTH.
An integer overflow in Google Chrome's Compositing component (fixed in 153.0.8010.47) lets a remote attacker leak cross-origin data by getting a victim to open a crafted HTML page. Exploitation requires user interaction (the victim must load the page) but no authentication or elevated privileges, and the impact is limited to confidentiality - integrity and availability are unaffected per the CVSS vector. There is no public exploit code or CISA KEV listing at time of analysis, and the CVSS base score is only 4.3, so this is a browser-patching hygiene issue rather than an emergency incident response trigger.
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.
An integer-overflow flaw (CWE-190) in Apple macOS lets an attacker who already occupies a privileged on-path network position crash or otherwise deny service to the affected system. The vulnerability is fixed in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8, so every earlier build of those three branches is exposed. There is no CISA KEV listing and no identified public exploit code, and EPSS places exploitation likelihood at roughly 0.17% (6th percentile), making this a routine patch-cycle item rather than an emergency for most fleets.
Denial of service in Apple iOS, iPadOS, and macOS results from an integer overflow (CWE-190) that a locally installed and executing application can trigger to cause unexpected system termination. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) confirms local access with low privileges, no user interaction, and impact limited to availability - there is no confidentiality or integrity loss and no remote or network-triggerable path. This is a genuinely low-priority issue despite its MEDIUM rating: EPSS is 0.20% (10th percentile), no public exploit code was identified at time of analysis, there is no CISA KEV listing, and Apple has shipped fixed versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27), leaving exposure limited to unpatched devices on which an attacker can already run code.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. There is no evidence of active exploitation or public exploit code at the time of analysis, and no vendor-listed fix version is available in the supplied intelligence.
Integer overflow in the Gravity scripting language's embedded JSON parser (gravity_json.c ≤ 0.9.7) allows remote attackers to cause heap allocation size miscalculation via crafted JSON input, resulting in an undersized buffer allocation and subsequent heap memory corruption or crash. The root flaw is a `unsigned long` truncation to 32 bits on LLP64 targets (64-bit Windows) when accumulating object key-string byte counts across a two-pass JSON parse, meaning any application embedding Gravity and feeding it attacker-controlled JSON is at risk on affected platforms. A public proof-of-concept exists at GitHub issue #447 and version 0.9.8 resolves all identified paths; no active exploitation (CISA KEV) has been recorded.
Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.
Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.
Integer overflow in msgpack-java's MessageUnpacker.skipValue() allows unauthenticated remote attackers to inject attacker-controlled data into deserialized fields by supplying a MAP32 container with an element count at or above 0x40000000. When the parser multiplies this count by 2 to traverse key-value pairs, the 32-bit result wraps, causing the cursor to halt prematurely and subsequent field reads to draw from attacker-supplied bytes rather than legitimate data. No vendor-released patch has been identified in available references; the issue is tracked at GitHub issue #1014 and disclosed by VulnCheck.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.
Denial of service in rclone prior to 1.75.1 allows unauthenticated remote attackers to crash individual HTTP or WebDAV connections by sending a Range request with an offset exceeding a symlink target's length. When `--links` or `links=true` is enabled, symlinks are exposed as `.rclonelink` pseudo-objects whose content is the target path string; the `openTranslatedLink` function sliced that string using a caller-controlled offset without bounds validation, producing a deterministic Go slice-bounds panic. Go's `net/http` recovers panics per connection rather than per process, limiting impact to request-level denial of service. No public exploit has been identified and the vendor-released fix is available in version 1.75.1.
Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.
Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.
Integer overflow in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privilege network attacker to crash the database service, causing a denial of service for all connected clients. The flaw (CWE-190) is triggered by crafted network input that induces an integer wraparound in SQL Server's processing logic, resulting in complete availability loss. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected versions.
Integer overflow vulnerabilities in Ollama's GGUF model decoder (versions 0.31.0-0.31.1) allow a remote attacker to crash the decoder by supplying a crafted GGUF model file containing malformed string lengths, tensor dimension counts, or array sizes. The overflow triggers in readGGUFV1String and related parsing functions in fs/ggml/gguf.go, causing Ollama to abort model loading and become temporarily unavailable. A public proof-of-concept exists (GitHub issue #17033) and a patch is available in v0.31.2-rc1; exploitation requires the target to load the malicious model file.
Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.
Integer overflow in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service condition. The vulnerability (CWE-190) is network-reachable but requires prior authentication, and its impact is limited to partial availability degradation with no confidentiality or integrity consequences. IBM has released a patch, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in Corosync's membership commit token processing crashes the daemon on 32-bit cluster nodes, enabling a denial-of-service attack from any adjacent network host. The CWE-190 flaw causes the length validation to be bypassed on 32-bit systems where arithmetic wraps before the bounds check is applied, resulting in an out-of-bounds memory access that kills the Corosync process. Modern 64-bit deployments of the same packages are explicitly not affected, substantially narrowing real-world exposure despite the CVSS 6.5 rating; no public exploit code or CISA KEV listing exists at time of analysis.
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a sufficiently large JSON document to crash any linked application on 32-bit-size builds. The overflow produces an undersized heap allocation that is freed, while a subsequent copy operation continues writing through the now-dangling pointer - a use-after-free sequence that terminates the host process. No public exploit code or active exploitation has been identified; impact is confined to denial of service, and the attack is constrained to 32-bit size builds of the library.
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions 2.14.13 through 3.32.1, enabling persistent denial of service against affected database records. The dimension count for a vector submitted with more than 65,535 elements silently wraps modulo 65,536 in a 16-bit header field, causing every subsequent read of the corrupted record to raise an exception. Applications that expose vector ingestion to untrusted users are at risk of permanent per-record data loss; no public exploit has been identified at time of analysis.
Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthenticated adjacent-network attacker to crash the daemon by sending a malformed DHCPv4 packet with an IP total length field smaller than the IP header length. The missing bounds check in ni_capture_inspect_udp_header() triggers an out-of-bounds read, causing a process crash depending on memory layout - resulting in a denial of service to network configuration. No information disclosure has been demonstrated, and no public exploit or CISA KEV listing exists at time of analysis.
Integer overflow in FFmpeg's libavfilter/vf_scale.c video scaling filter allows a remote attacker to crash the FFmpeg process by delivering a crafted video file that a user then opens or processes. Affected is FFmpeg development build N-122528-gdd2976b9e1, a git-snapshot identifier rather than a stable release. No public exploit and no active exploitation are identified at time of analysis; EPSS sits at 0.15% (4th percentile), confirming low observed exploitation probability despite the ubiquitous deployment footprint of FFmpeg.
Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.
CorvusSKK, a Windows-based SKK Japanese input method editor by Sasaki Nobuyuki, contains a signed 32-bit integer overflow (CWE-190) in its tar-format dictionary file size parsing, which can allow malicious data to be written to a dictionary file when a user opens a crafted input. All versions prior to 3.3.4 are affected; version 3.3.4 was released to address this flaw alongside a separate Lua-related vulnerability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation.
Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Integer overflow in OpenEXR's deep tiled image decoder crashes any application that opens a crafted EXR file, affecting versions 3.1.0 through 3.4.13 across all three maintained release branches. The overflow occurs in OpenEXRCore's unpack_sample_table() function during the standard exr_decoding_run path, meaning no non-default configuration is required - only that the file uses the deep tiled variant of the format. Impact is denial of service via crash (no code execution demonstrated); no public exploit code exists and this vulnerability is not listed in CISA KEV.
Infinite-loop denial of service in OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 allows an attacker to permanently hang any process that parses a crafted EXR image by triggering an integer overflow in the sample-count helper roundListSizeUp(). When UINT_MAX is passed as a sample-count value, 32-bit unsigned left-shift arithmetic wraps the accumulator to zero, producing a loop condition that never terminates. The vulnerability is reachable through public OpenEXRUtil APIs, making it exploitable wherever applications accept externally-supplied EXR files. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in OpenEXR 3.4.0 through 3.4.12 allows any application calling exr_start_read() on untrusted input to be unconditionally aborted by a crafted HTJ2K-compressed EXR file containing a QCD marker with lower five bits set to zero. The flaw chains two weaknesses: OpenJPH's vendored assertion-based validation calls abort() instead of returning a recoverable error, and OpenEXR's error handling wraps only its internal HT header parser, leaving downstream codestream construction calls entirely unprotected. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial triggering condition and prevalence of OpenEXR in automated rendering pipelines make this a meaningful denial-of-service risk for media production infrastructure.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.
Heap buffer overflow in msgpack-c through version 7.0.1 results from an integer overflow in msgpack_unpacker_expand_buffer, where unchecked size_t addition of the requested reservation size and current buffer usage wraps to near-zero on near-SIZE_MAX inputs, causing the allocator to receive a massively undersized target while the function falsely reports success to the caller. Integrations that pass attacker-controlled lengths to the msgpack_unpacker_reserve_buffer API - such as custom length-prefixed streaming transports - can trigger subsequent heap overwrites when the caller writes the full declared length into the undersized buffer. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a specific non-default integration pattern not present in msgpack-c's own internal decode paths.
TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote client to crash their own connection by sending a STUN message with a crafted body-length field value between 65520 and 65532. The integer overflow in stun_get_message_len_str() causes the framing layer to misinterpret the stream, consuming only 4-16 bytes and treating remaining data as a new message, ultimately dropping the attacking client's connection. No other clients or the server process are impacted; vendor-released patch version 4.15.0 is available and no active exploitation is confirmed.
Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.
Authenticated denial-of-service in IBM Virtualization Management Interface (VMI) allows an administrator-level attacker positioned on an adjacent network to trigger an integer overflow that crashes the VMI process. Affected firmware spans FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. While the VMI restarts automatically after a single crash, repeated exploitation can sustain a meaningful availability disruption; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow (CWE-190) in IBM Power Firmware allows an attacker with service-level access to the service processor to supply a specially crafted command that leaks the contents of hardware registers that are architecturally isolated from service processor visibility. Affected firmware lines include FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80, covering IBM Power server deployments running these specific firmware versions. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in ImageMagick's pixel-cache allocation path (GetVirtualPixels / SetPixelCacheNexusPixels) lets a locally supplied crafted call with attacker-controlled width, height, and channel/metacontent values overflow MagickSizeType arithmetic and write past a heap buffer, crashing the affected process. All ImageMagick releases prior to 6.9.13-56 (6.x line) and 7.1.2-31 (7.x line) are affected; the assessed CVSS is 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning impact is confined to a denial of service with no confidentiality or integrity loss and no demonstrated code execution. Exploitation is local and high-complexity because a precise overflow condition must be induced; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided in the available intelligence. Vendor-released patches exist in 6.9.13-56 and 7.1.2-31.
An authenticated remote attacker with a valid SSH session can trigger a one-byte out-of-bounds stack write in wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms by sending a crafted SFTP path, which can corrupt an adjacent stack value and crash the server process. The flaw is an unsigned integer underflow (CWE-191) in which the pointer/length math in wolfSSH_RealPath() and wstrncat() wraps once the accumulated path reaches roughly half the output buffer, causing a terminating null byte to be written one byte past the end of the stack buffer. The impact is limited to a single-byte corruption causing denial of service rather than arbitrary write or code execution, and no public exploit has been identified at time of analysis; a separate, more severe unbounded-copy condition exists only for third-party applications that call the public wolfSSH_RealPath() API with an output buffer smaller than the input path.
Integer overflow leading to a heap-based buffer overflow in GIMP's DICOM export plug-in allows a local user to corrupt memory when exporting an image whose width and height are large enough that the 32-bit width × height × bytes-per-pixel product wraps and undersizes the heap allocation. Exploitation requires the victim to initiate the export and involves a crafted image with extremely large dimensions, so the attack is local (AV:L) and user-interaction dependent (UI:R), with high attack complexity (AC:H); the assessed CVSS is 6.3 with high integrity and availability impact but no confidentiality impact. No public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV), and no vendor-released patch version is identified in the available data.
Cross-origin data disclosure in Google Chrome desktop (Compositing component) affects builds prior to 155.0.8059.39, where a remote attacker can use a crafted HTML page to exploit an integer overflow and read limited data belonging to another origin. Exploitation is not passive: per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) the victim must load the attacker-controlled page, so a malicious-site, malvertising, or social-engineering delivery is required, and the impact is confined to low-confidentiality leakage with no integrity or availability effect. No public exploit code has been identified at time of analysis - this is not on CISA KEV - and the vendor patch is already available, meaning the effective window is mostly determined by how quickly browsers auto-update; despite the 'High' Chromium internal severity label, this is a moderate-severity, low-real-risk issue.
Heap corruption in GNU Aspell's personal-wordlist handling lets a local attacker crash a user's spell-checking session by supplying a crafted dictionary file. All Aspell releases before 0.60.8.3 are affected: when a wordlist containing a word whose length is an exact multiple of 256 bytes is loaded, WritableDict::add() in modules/speller/default/writable.cpp stores the word length in a single byte, truncating it and corrupting heap memory, which results in denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor fix was published as commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and is slated for release in version 0.60.8.3. With a CVSS 4.0 base score of 1.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, this is a genuinely low-priority issue: the attack is local-only, needs the victim to actively load an attacker-supplied dictionary, requires the specific multiple-of-256 length condition, and yields availability loss only.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Cross-origin data leakage in Google Chrome versions prior to 154.0.8037.97 stems from an integer overflow in the Skia 2D graphics engine that a remote attacker can trigger by convincing a victim to load a crafted HTML page, allowing data belonging to other origins to be read. The flaw is remotely reachable by unauthenticated attackers per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N), but it mandates user interaction (UI:R) and carries only low confidentiality impact with no integrity or availability effect, for an overall CVSS of 4.3. EPSS is just 0.17% (6th percentile) and there is no public exploit identified at time of analysis, while Chromium's own 'High' severity label reflects the impact class rather than demonstrated exploitability; a vendor patch is available in Chrome 154.0.8037.97.
Integer overflow in Google Chrome's Compositing component affects all builds prior to 154.0.8037.97 and allows remote attackers to leak cross-origin data when a victim navigates to a crafted HTML page (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw is unauthenticated from a network perspective but requires user interaction - the victim must actively load attacker-controlled content - and it is confined to confidentiality impact, with no integrity or availability effect; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. EPSS probability is low at 0.18% (6th percentile) and CISA's SSVC rates exploitation as none and automatable as no, so this is a moderate-priority patch rather than an emergency one.
An integer overflow in the blosclz decompression path of C-Blosc2 3.3.2 and earlier allows a remote attacker who can supply crafted compressed data to a program that calls blosclz_decompress to corrupt an output-buffer bounds computation, potentially causing memory corruption. Successful exploitation depends entirely on a consuming application accepting and decompressing attacker-influenced Blosc2/blosclz data, and the vendor characterizes the attack as high complexity and difficult; per the CVSS 4.0 vector the impact is Low across confidentiality, integrity, and availability and no privileges or user interaction are required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is assessed as a real but low-priority memory-safety defect; the vendor-released fix is version 3.3.3.
Integer overflow in the image-encoding routines of nothings/stb (stb_image_write.h, stb through version 1.16) allows remote attackers who can influence image dimensions or channel counts passed to stbi_write_png_to_mem, stbi_write_jpg_core, or stbi_write_tga_core to corrupt memory or crash the encoding process. Publicly available exploit code exists (no CISA KEV entry, so active exploitation is not confirmed), and the flaw requires an application that feeds attacker-controlled sizing into the encoder rather than simple network reachability. The published CVSS 4.0 score of 6.9 overstates practical risk: an independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N with only low integrity and availability impact and no confidentiality impact - a genuine but modest-severity issue whose real exposure depends entirely on whether the host application passes untrusted dimensions to the write functions.
Integer overflow in the hexwave_init() function of Nothings stb (stb_hexwave.h) corrupts allocation sizing when an application passes attacker-influenced width or oversample arguments during wave-table initialization. Exploitation is remote and unauthenticated at the library level and publicly available exploit code exists (no confirmed active exploitation), but the practical attack surface is limited: these are initialization parameters normally hardcoded by the developer, so exploitation requires an application that surfaces them to untrusted input. Impact is bounded to low integrity and availability loss, consistent with memory corruption or a crash rather than reliable code execution, and the project has not responded to the issue report, leaving no confirmed vendor patch.
Signed integer overflow in the Splash rasterization backend of Freedesktop Poppler (SplashClip::clipToPath in splash/SplashClip.cc) lets a local attacker crash or destabilize any Poppler-backed application that renders an attacker-crafted PDF, yielding a denial-of-service primitive with no confidentiality or integrity impact. Versions up to and including 26.08.0 are affected, publicly available exploit code exists (no KEV listing, so this is not confirmed active exploitation), and the flaw is fixed in 26.09.0. Exploitation is local in nature and requires the victim to open or render the malicious document, so despite the alarming CWE-190 integer-overflow class the realistic risk is low and availability-only.
Heap under-allocation in U-Boot's SquashFS directory-table parser (fs/squashfs/sqfs.c) allows an attacker who supplies a crafted SquashFS filesystem image to trigger out-of-bounds heap writes and crash the bootloader, producing a denial of service during or after boot. All U-Boot releases before 2026.10-rc4 that are compiled with SquashFS support are affected, and exploitation requires the device to read and parse an attacker-controlled image from boot media, which is why the vendor treats this as a physical/local-vector issue (CVSS 4.0 base 5.2; the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). No public exploit code has been identified at time of analysis, and the flaw was reported by VulnCheck alongside a vendor fix commit.
A signed integer overflow (CWE-190) in Poppler's TrueType font conversion path, specifically FoFiTrueType::cvtSfnts in fofi/FoFiTrueType.cc, lets an attacker who supplies a crafted sfnt/TrueType font - typically embedded inside a PDF that is rendered or converted with tools such as pdftops - corrupt the handling of font table lengths during conversion. The defect affects Poppler 26.06.0, 26.07.0 and 26.08.0 and is reachable only locally, when a victim or local process opens or converts the malicious file; the assessed impact is bounded to limited integrity loss (VI:L) with no confidentiality or availability impact, so this is not a straightforward remote code execution issue. Publicly available exploit code exists and has been disclosed alongside a signed-overflow write-up in a public GitHub repository, and upstream has published a fix as commit 245d3c6823377755f2c1d5fdddd010279c6ed94d (merge request !2326); despite the public PoC, the CVSS v4.0 score of 4.8 and the vendor vector (AV:L/PR:L, VI:L, E:P) keep this a low-priority issue for most deployments.
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage handling by supplying a crafted 'pct=' value in a DMARC DNS TXT record. Publicly available exploit code exists, but the vulnerability is not confirmed actively exploited (CISA KEV). Exploitation requires the target to be actively performing DMARC verification on inbound mail and the attacker to control a queried domain's DMARC record; assessed impact is limited to integrity of policy-percentage handling and minor availability disruption, not RCE or data disclosure.
Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.
CVE-2025-14181 currently has no usable detail: the record contains no description, no CVSS score, no CVSS vector, and no CWE, and the only supplied attribution is the vendor source "ubuntu". Because the affected component, the impact class, and the attack vector are all undefined, it is not possible to state who is affected beyond the Ubuntu distribution packaging channel, nor what an attacker could achieve; authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis and no CISA KEV entry is present. Risk cannot be meaningfully assessed from the available data, so this identifier should be triaged as unresolved rather than as a confirmed threat until the Ubuntu security advisory and NVD entry are populated.
Denial of service in Bento4 1.6.0.0 arises when the MP4 parser processes a crafted H.264/AVC or H.265/HEVC configuration atom (avcC or hvcC) whose declared atom size is smaller than AP4_ATOM_HEADER_SIZE. The size calculation underflows, AP4_AvccAtom::Create() or AP4_HvccAtom::Create() then passes an invalid or NULL pointer into the AP4_DataBuffer copy path, and the hosting application terminates. The CVSS vector is AV:L/PR:N/UI:N with only availability impact, so exploitation requires the malicious file to reach a local parsing path; no public exploit identified at time of analysis, CISA KEV status is not indicated in the supplied data, and EPSS is 0.15% (3rd percentile).
CVE-2026-6103 is an as-yet uncharacterized security issue in software distributed and maintained through Ubuntu, reported to this pipeline solely by the Ubuntu vendor feed with no accompanying description, CVSS vector, or CWE classification. Because the report carries no affected package name, no version range, and no attack-vector metadata, it is not possible to state who is affected beyond Ubuntu users of whatever component the Ubuntu Security Tracker assigns to this CVE, or what an attacker could achieve. No public exploit identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied; risk cannot be meaningfully assessed from the available data until the Ubuntu Security Tracker entry (and the corresponding NVD record) is retrieved.
Integer overflow in the ALSA topology decoder of alsa-lib through 1.2.16.1 lets a crafted .tplg topology file wrap the combined control-element size calculation, so the decoder passes its bounds check and reads past the end of the topology buffer, potentially disclosing process memory or crashing the application. Exploitation is local (AV:L) and requires the victim to load an attacker-supplied topology file (UI:P/UI:R, PR:N); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Independent assessment rates the real-world risk as low-to-moderate: topology files are normally trusted, system-provided sound-card configuration data, so the flaw is only practically reachable where alsa-lib processes topology input from an untrusted source, and the demonstrated impact is limited to low confidentiality and low availability loss.
Parsing a crafted PE file with a malformed IMAGE_BASE_RELOCATION BlockSize field can crash or disrupt JusticeRage Manalyze 1.0.0 through an integer underflow in PE::_parse_relocations, a low-severity denial-of-service condition confined to the analysis tool itself. The attack is local only: the victim must run Manalyze (manually as a malware analyst, or automatically in a triage/sandbox pipeline) against the attacker-supplied sample, and there is no code execution, confidentiality loss, or integrity loss - only the parsing routine misbehaves. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the upstream commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 adds the missing BlockSize validation; the EPSS signal for this niche tooling bug is consistent with a low real-world priority.
Risk for CVE-2026-95308 cannot be meaningfully assessed from the intelligence supplied: the record carries no description, no CVSS score or vector, no CWE, and no CPE or package identifiers, and the sole source attribution is the Ubuntu security team. This indicates an issue tracked against some package within the Ubuntu/Debian ecosystem, but the affected component, the required privilege level, and whether user interaction or a non-default configuration is necessary all remain unconfirmed. No public exploit code has been identified at time of analysis, and there is no KEV listing, so there is currently no signal of active exploitation. The actionable next step is to obtain the corresponding Ubuntu Security Notice (USN) for CVE-2026-95308, which will establish the real exploitation conditions and severity.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
An authenticated Netdata child agent can crash its parent agent by streaming an oversized DIMENSION SLOT value in the plugins.d protocol, triggering an integer overflow that leads to a heap out-of-bounds write and termination of the parent process. Affected deployments are Netdata parent-child streaming setups running versions prior to 2.10.4 (including nightly builds earlier than 2.10.0-782-nightly); the attacker must already control or have compromised a child agent that is authenticated to the parent, so exploitation is limited to denial of service with no confidentiality or integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is moderate rather than urgent, and it is fully closed by upgrading to the fixed release.
Heap memory corruption and denial of service in radare2 versions prior to 6.2.0 occur when the CPython .pyc marshal parser processes a crafted bytecode file that declares a string length of 0xffffffff, wrapping the size-plus-one allocation to zero before attacker-controlled data and fill bytes are written past the heap buffer. Exploitation is local and requires user interaction - an analyst must open or inspect the malicious .pyc with r2 or rabin2 - and no privileges are needed per the CVSS vector (AV:L/PR:N/UI:R), with impact confined to corrupting or crashing the analysis process. Arbitrary code execution is possible in principle but has not been demonstrated, no public exploit code has been identified at time of analysis, and the 5.5 CVSS score reflects a genuinely low-priority issue for most environments. Only workflows that routinely open untrusted .pyc files (malware analysis, CTF, reverse-engineering) are realistically at risk.
Out-of-bounds read in the XS encoder of Perl's Net::IDN::Punycode (all versions before 2.590) lets a remote attacker who can influence a string passed to encode_punycode push a single byte from outside the module's 36-entry punycode digit table into the encoded result, or crash the calling process. The flaw is a signed-integer overflow of the punycode delta accumulator in the compiled XS backend; the pure-Perl PP backend is not affected, so exposure is limited to applications that have the XS module installed and feed it attacker-controlled labels, such as IDN/domain-to-ASCII conversion pipelines. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), impact is bounded to a one-byte information leak or a denial-of-service crash with no code execution or integrity impact, and no public exploit code has been identified at time of analysis; the vendor has shipped a fix in 2.590.
Integer overflow in MPack 1.1.1's mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() helpers causes the allocation size computation (node.data->len + 1) to wrap to zero when a parsed MessagePack node advertises a length of SIZE_MAX, yielding an undersized buffer allocation and, in the officially scored path, a denial-of-service/crash. Exploitation requires the consuming application to use MPack's node/tree reader API and to call one of these helpers on a node whose length is attacker-controlled; it is realistically reachable on 32-bit platforms where SIZE_MAX equals UINT32_MAX (~4 GB) and generally infeasible on 64-bit platforms. The assessed vector is local (AV:L) with high attack complexity (AC:H) and no authentication or user interaction requirement (PR:N/UI:N), so remote reachability depends entirely on whether the host application exposes the parser to untrusted network input; there is no public exploit identified at time of analysis and EPSS is low at 0.20% (10th percentile).
A crafted bulk-insert payload triggers an integer overflow in FalkorDB's _BulkInsert_ReadProperty parser (/bulk_insert.c), crashing the module and taking down the Redis process that hosts it, for a denial-of-service condition in v4.20.1. The assessed CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) means remote, unauthenticated, no-interaction exploitation with availability-only impact; in practice the effective bar depends on whether the Redis deployment enforces requirepass or ACL authentication, which would raise the requirement to valid credentials. No public exploit code identified at time of analysis, no CISA KEV listing, and the sole reference is the vendor GitHub issue FalkorDB/FalkorDB#2326 - consistent with an independent assessment of a moderate-severity, availability-only issue of low real-world priority.
Integer underflow in the PE parser of Manalyze 1.0.0 (PE::_parse_debug in manape/pe.cpp) can be triggered when the tool processes a crafted Portable Executable whose IMAGE_DEBUG_MISC debug-directory entry declares a Length smaller than the misc structure header, causing the computed string length to wrap to a very large unsigned value and the parser to read beyond the intended buffer. Exploitation is not remote in practice: it requires a local user (typically a malware analyst) to voluntarily run the unpatched Manalyze CLI against the malicious sample, so the assessed risk is low (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), with impact largely confined to the parsing process - the tag 'Information Disclosure' reflects the out-of-bounds read potential rather than confirmed data exfiltration. No public exploit code and no active exploitation have been identified at time of analysis, and an upstream fix commit (3e299685759f4f767088871de58c5d07f98ee382) is available.
Signed 32-bit integer overflow in SerenityOS LibGfx's BMP decoder can crash the decoder when a victim opens a crafted BMP whose height field is INT32_MIN, affecting BMPLoader.cpp's decode_bmp_pixel_data and related DIB parsing. Publicly available exploit code exists, but exploitation requires user interaction and high complexity, and the realistic impact is minor availability loss only, with no code execution or data disclosure demonstrated. The CVSS 4.0 score of 2.3 and the independent assessment agree this is a low-priority issue.
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application that parses an attacker-supplied SoundFont 2 file. The SF2 parser derives the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without first rejecting chunks smaller than a single record, so a zero-sized DMOD chunk underflows the unsigned subtraction to UINT_MAX and the loader attempts to allocate billions of SFMod structures until process memory is exhausted. Rated CVSS 6.2 (AV:L/AC:L/PR:N/UI:N, availability-only), the issue requires only that a crafted .sf2 file be loaded locally (no privileges and no user interaction beyond opening the file), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-released patch is version 2.5.6.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-size check, triggering an approximately 4 GB pool-cue allocation and billions of out-of-bounds reads that crash the process, producing a denial of service against the affected 2.5.0 through 2.5.5 releases. Exploitation requires the library to be built with enable-native-dls=ON and an attacker-supplied DLS file to be opened by the application; the CVSS vector indicates no privileges are required (PR:N), and no public exploit code was identified at time of analysis. The vendor has fixed the flaw in FluidSynth 2.5.6.
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted DLS SoundFont file: an integer overflow in the parser's articulation-chunk size check lets the loader run roughly a billion out-of-bounds 12-byte iterations, causing a crash or hang. The flaw affects versions 2.5.0 through 2.5.5 and is fixed in 2.5.6; exploitation requires the target to be built with the non-default CMake option enable-native-dls set to ON and to load the attacker-supplied file (unauthenticated per the CVSS PR:N vector, but the attack vector is local and the malicious file must reach the application). No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - there is no code execution or data disclosure.
An integer-overflow flaw in libheif's RGB-to-YCbCr conversion path (libheif/color-conversion/rgb2yuv.cc) can crash an application that encodes extremely large RGB images constructed via heif_image_create() and heif_image_add_plane() before calling heif_context_encode_image(); a 32-bit stride field wraps, so the conversion loop computes an invalid input pointer and reads past the end of the allocated interleaved plane. Affected deployments are those running libheif versions prior to 1.19.6 that expose the ENCODE path to caller- or attacker-influenced image dimensions - pure decode/parsing workflows are not affected. Impact is limited to process termination (no code execution, no data disclosure), and no public exploit code was identified at time of analysis.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
Rendering a crafted PDF with Freedesktop Poppler 26.07.0 can trigger a signed integer overflow in the TrueType font handler FoFiTrueType::mapCodeToGID when an embedded font supplies a manipulated segCnt value, producing a crash or a bounded out-of-bounds read rather than confirmed code execution. The flaw is remotely reachable with no authentication (CVSS 4.0 PR:N, CVSS 3.1 PR:N) but requires the victim or an automated pipeline to open or convert the attacker-supplied document (UI:P/UI:R), so it is not a hands-off network exploit; publicly available exploit code exists but there is no indication of confirmed active exploitation (no CISA KEV listing). With a base score of 5.3 and C:L/I:L/A:L on the assessed 3.1 vector, this is a moderate, opportunistic-risk issue rather than a top-tier priority, and it matters most to environments that automatically render or convert untrusted PDFs at scale.
Integer overflow in the JBIG2 code-table parser (JBIG2Stream::readCodeTableSeg) of Freedesktop Poppler 26.07.0 allows a remote attacker to crash or destabilize the rendering process by supplying a crafted PDF that embeds a malicious JBIG2 image stream. The flaw is reachable without authentication, but requires the victim to open the document or have a batch tool such as pdftoppm or pdfimages process it, and the independent assessment limits realistic impact to denial of service (integrity and confidentiality are unaffected). Publicly available exploit code exists (a write-up and PoC linked from the CVE references), and the CISA KEV catalog does not list this CVE, so it is a low-to-moderate, non-urgent memory-safety issue rather than a confirmed actively exploited threat.
Integer overflow in Freedesktop Poppler 26.07.0's SampledFunction::SampledFunction (poppler/Function.cc) allows unauthenticated remote attackers to crash PDF-rendering applications by supplying a crafted PDF with an oversized BitsPerSample value, resulting in an availability-only denial of service. Exploitation requires a victim to open or render the malicious file (UI:P/UI:R), and publicly available exploit code exists; the issue is not confirmed as actively exploited in CISA KEV. With a CVSS 4.0 base score of 2.1 and an independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, the risk is low and confined to availability with no demonstrated confidentiality or integrity impact.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
A heap-based buffer overflow in the Samsung Escargot JavaScript engine is reachable when a crafted bytecode-cache file is parsed, driven by an integer wraparound (CWE-190) in the string-table length handling inside CodeCacheReader::loadStringTable. Exploitation requires local write access to the engine's bytecode-cache directory (CVSS 5.5, AV:L/PR:L), and the impact is limited to availability - a crash or memory-corruption-induced denial of service with no confidentiality or integrity loss. No public exploit code or CISA KEV listing was identified at time of analysis, and the upstream fix (Samsung PR #1650) adds a bounds check rejecting any maxLength above STRING_MAXIMUM_LENGTH.
An integer overflow in Google Chrome's Compositing component (fixed in 153.0.8010.47) lets a remote attacker leak cross-origin data by getting a victim to open a crafted HTML page. Exploitation requires user interaction (the victim must load the page) but no authentication or elevated privileges, and the impact is limited to confidentiality - integrity and availability are unaffected per the CVSS vector. There is no public exploit code or CISA KEV listing at time of analysis, and the CVSS base score is only 4.3, so this is a browser-patching hygiene issue rather than an emergency incident response trigger.
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.
An integer-overflow flaw (CWE-190) in Apple macOS lets an attacker who already occupies a privileged on-path network position crash or otherwise deny service to the affected system. The vulnerability is fixed in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8, so every earlier build of those three branches is exposed. There is no CISA KEV listing and no identified public exploit code, and EPSS places exploitation likelihood at roughly 0.17% (6th percentile), making this a routine patch-cycle item rather than an emergency for most fleets.
Denial of service in Apple iOS, iPadOS, and macOS results from an integer overflow (CWE-190) that a locally installed and executing application can trigger to cause unexpected system termination. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) confirms local access with low privileges, no user interaction, and impact limited to availability - there is no confidentiality or integrity loss and no remote or network-triggerable path. This is a genuinely low-priority issue despite its MEDIUM rating: EPSS is 0.20% (10th percentile), no public exploit code was identified at time of analysis, there is no CISA KEV listing, and Apple has shipped fixed versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27), leaving exposure limited to unpatched devices on which an attacker can already run code.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. There is no evidence of active exploitation or public exploit code at the time of analysis, and no vendor-listed fix version is available in the supplied intelligence.
Integer overflow in the Gravity scripting language's embedded JSON parser (gravity_json.c ≤ 0.9.7) allows remote attackers to cause heap allocation size miscalculation via crafted JSON input, resulting in an undersized buffer allocation and subsequent heap memory corruption or crash. The root flaw is a `unsigned long` truncation to 32 bits on LLP64 targets (64-bit Windows) when accumulating object key-string byte counts across a two-pass JSON parse, meaning any application embedding Gravity and feeding it attacker-controlled JSON is at risk on affected platforms. A public proof-of-concept exists at GitHub issue #447 and version 0.9.8 resolves all identified paths; no active exploitation (CISA KEV) has been recorded.
Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.
Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.
Integer overflow in msgpack-java's MessageUnpacker.skipValue() allows unauthenticated remote attackers to inject attacker-controlled data into deserialized fields by supplying a MAP32 container with an element count at or above 0x40000000. When the parser multiplies this count by 2 to traverse key-value pairs, the 32-bit result wraps, causing the cursor to halt prematurely and subsequent field reads to draw from attacker-supplied bytes rather than legitimate data. No vendor-released patch has been identified in available references; the issue is tracked at GitHub issue #1014 and disclosed by VulnCheck.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.
Denial of service in rclone prior to 1.75.1 allows unauthenticated remote attackers to crash individual HTTP or WebDAV connections by sending a Range request with an offset exceeding a symlink target's length. When `--links` or `links=true` is enabled, symlinks are exposed as `.rclonelink` pseudo-objects whose content is the target path string; the `openTranslatedLink` function sliced that string using a caller-controlled offset without bounds validation, producing a deterministic Go slice-bounds panic. Go's `net/http` recovers panics per connection rather than per process, limiting impact to request-level denial of service. No public exploit has been identified and the vendor-released fix is available in version 1.75.1.
Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.
Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.
Integer overflow in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privilege network attacker to crash the database service, causing a denial of service for all connected clients. The flaw (CWE-190) is triggered by crafted network input that induces an integer wraparound in SQL Server's processing logic, resulting in complete availability loss. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected versions.
Integer overflow vulnerabilities in Ollama's GGUF model decoder (versions 0.31.0-0.31.1) allow a remote attacker to crash the decoder by supplying a crafted GGUF model file containing malformed string lengths, tensor dimension counts, or array sizes. The overflow triggers in readGGUFV1String and related parsing functions in fs/ggml/gguf.go, causing Ollama to abort model loading and become temporarily unavailable. A public proof-of-concept exists (GitHub issue #17033) and a patch is available in v0.31.2-rc1; exploitation requires the target to load the malicious model file.
Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.
Integer overflow in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service condition. The vulnerability (CWE-190) is network-reachable but requires prior authentication, and its impact is limited to partial availability degradation with no confidentiality or integrity consequences. IBM has released a patch, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in Corosync's membership commit token processing crashes the daemon on 32-bit cluster nodes, enabling a denial-of-service attack from any adjacent network host. The CWE-190 flaw causes the length validation to be bypassed on 32-bit systems where arithmetic wraps before the bounds check is applied, resulting in an out-of-bounds memory access that kills the Corosync process. Modern 64-bit deployments of the same packages are explicitly not affected, substantially narrowing real-world exposure despite the CVSS 6.5 rating; no public exploit code or CISA KEV listing exists at time of analysis.
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a sufficiently large JSON document to crash any linked application on 32-bit-size builds. The overflow produces an undersized heap allocation that is freed, while a subsequent copy operation continues writing through the now-dangling pointer - a use-after-free sequence that terminates the host process. No public exploit code or active exploitation has been identified; impact is confined to denial of service, and the attack is constrained to 32-bit size builds of the library.
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions 2.14.13 through 3.32.1, enabling persistent denial of service against affected database records. The dimension count for a vector submitted with more than 65,535 elements silently wraps modulo 65,536 in a 16-bit header field, causing every subsequent read of the corrupted record to raise an exception. Applications that expose vector ingestion to untrusted users are at risk of permanent per-record data loss; no public exploit has been identified at time of analysis.
Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthenticated adjacent-network attacker to crash the daemon by sending a malformed DHCPv4 packet with an IP total length field smaller than the IP header length. The missing bounds check in ni_capture_inspect_udp_header() triggers an out-of-bounds read, causing a process crash depending on memory layout - resulting in a denial of service to network configuration. No information disclosure has been demonstrated, and no public exploit or CISA KEV listing exists at time of analysis.
Integer overflow in FFmpeg's libavfilter/vf_scale.c video scaling filter allows a remote attacker to crash the FFmpeg process by delivering a crafted video file that a user then opens or processes. Affected is FFmpeg development build N-122528-gdd2976b9e1, a git-snapshot identifier rather than a stable release. No public exploit and no active exploitation are identified at time of analysis; EPSS sits at 0.15% (4th percentile), confirming low observed exploitation probability despite the ubiquitous deployment footprint of FFmpeg.
Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.
CorvusSKK, a Windows-based SKK Japanese input method editor by Sasaki Nobuyuki, contains a signed 32-bit integer overflow (CWE-190) in its tar-format dictionary file size parsing, which can allow malicious data to be written to a dictionary file when a user opens a crafted input. All versions prior to 3.3.4 are affected; version 3.3.4 was released to address this flaw alongside a separate Lua-related vulnerability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation.
Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Integer overflow in OpenEXR's deep tiled image decoder crashes any application that opens a crafted EXR file, affecting versions 3.1.0 through 3.4.13 across all three maintained release branches. The overflow occurs in OpenEXRCore's unpack_sample_table() function during the standard exr_decoding_run path, meaning no non-default configuration is required - only that the file uses the deep tiled variant of the format. Impact is denial of service via crash (no code execution demonstrated); no public exploit code exists and this vulnerability is not listed in CISA KEV.
Infinite-loop denial of service in OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 allows an attacker to permanently hang any process that parses a crafted EXR image by triggering an integer overflow in the sample-count helper roundListSizeUp(). When UINT_MAX is passed as a sample-count value, 32-bit unsigned left-shift arithmetic wraps the accumulator to zero, producing a loop condition that never terminates. The vulnerability is reachable through public OpenEXRUtil APIs, making it exploitable wherever applications accept externally-supplied EXR files. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in OpenEXR 3.4.0 through 3.4.12 allows any application calling exr_start_read() on untrusted input to be unconditionally aborted by a crafted HTJ2K-compressed EXR file containing a QCD marker with lower five bits set to zero. The flaw chains two weaknesses: OpenJPH's vendored assertion-based validation calls abort() instead of returning a recoverable error, and OpenEXR's error handling wraps only its internal HT header parser, leaving downstream codestream construction calls entirely unprotected. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial triggering condition and prevalence of OpenEXR in automated rendering pipelines make this a meaningful denial-of-service risk for media production infrastructure.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.
Heap buffer overflow in msgpack-c through version 7.0.1 results from an integer overflow in msgpack_unpacker_expand_buffer, where unchecked size_t addition of the requested reservation size and current buffer usage wraps to near-zero on near-SIZE_MAX inputs, causing the allocator to receive a massively undersized target while the function falsely reports success to the caller. Integrations that pass attacker-controlled lengths to the msgpack_unpacker_reserve_buffer API - such as custom length-prefixed streaming transports - can trigger subsequent heap overwrites when the caller writes the full declared length into the undersized buffer. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a specific non-default integration pattern not present in msgpack-c's own internal decode paths.
TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote client to crash their own connection by sending a STUN message with a crafted body-length field value between 65520 and 65532. The integer overflow in stun_get_message_len_str() causes the framing layer to misinterpret the stream, consuming only 4-16 bytes and treating remaining data as a new message, ultimately dropping the attacking client's connection. No other clients or the server process are impacted; vendor-released patch version 4.15.0 is available and no active exploitation is confirmed.
Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.
Authenticated denial-of-service in IBM Virtualization Management Interface (VMI) allows an administrator-level attacker positioned on an adjacent network to trigger an integer overflow that crashes the VMI process. Affected firmware spans FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. While the VMI restarts automatically after a single crash, repeated exploitation can sustain a meaningful availability disruption; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow (CWE-190) in IBM Power Firmware allows an attacker with service-level access to the service processor to supply a specially crafted command that leaks the contents of hardware registers that are architecturally isolated from service processor visibility. Affected firmware lines include FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80, covering IBM Power server deployments running these specific firmware versions. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.