Integer Overflow

Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).

Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

An unauthenticated remote client can disclose stale memory contents from a libIEC61850 server running the MMS file service, because a crafted out-of-range initialPosition in a fileOpen request drives an unsigned integer underflow in the fileRead path and produces an oversized response that appends leftover bytes from the reused connection buffer. All versions prior to 1.6.2 are affected, and exploitation requires only network reachability to the MMS/TCP listener with the file service enabled - a non-default configuration. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the independently assessed confidentiality impact is moderate rather than catastrophic since the attacker cannot select or guarantee the sensitivity of the leaked bytes.

Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a remote adjacent-network attacker to desynchronize the parser from the declared body length on LP64 builds, enabling either request smuggling in persistent or proxied contexts or a denial of service by forcing a worker to wait for an oversized body. Affected are all pupnp releases prior to 2.0.2 across the whole CPE range cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:*; no authentication (PR:N) and no user interaction (UI:N) are required, though exploitation is limited to adjacent/link-local reachability (AV:A) and to 64-bit builds where long is 64 bits and int is 32 bits. No public exploit identified at time of analysis; vendor-released patch: 2.0.2.

Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.

Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).

Out-of-bounds read in the Driftregion iso14229 UDS server library before version 0.10.1 lets an unauthenticated sender crash the diagnostic stack or disclose adjacent memory by submitting a short RequestFileTransfer (SID 0x38) request whose filePathAndNameLength field is set to 0xFFFC-0xFFFF, wrapping the length arithmetic and defeating the buffer-length check before file-transfer callbacks read past the receive buffer. The issue carries a CVSS 4.0 base score of 8.8 and is assessed as AV:N/AC:L/PR:N/UI:N with low confidentiality and high availability impact (CWE-190 integer wraparound), so no credentials or user interaction are required once the handler is reachable. No public exploit code has been identified at time of analysis and no EPSS score was supplied; real-world exposure is gated by transport, since AV:N holds only where the server is reachable over an IP transport such as DoIP, whereas the typical CAN/ISO-TP deployment restricts an attacker to the vehicle or device bus.

Integer overflow in NASA's F´ (F Prime) Svc::FileUplink component allows an operator with command-link access to bypass the declared upload-size check and write file data beyond the intended boundary, corrupting file integrity and enabling large sparse-file growth or storage/resource exhaustion. The flaw affects releases prior to 4.2.0 and is reachable by any attacker who can deliver a crafted DATA packet carrying a byteOffset and dataSize whose unsigned U32 sum wraps below the declared file size; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) reflects network reachability, low complexity, low privileges, no user interaction, high integrity and availability impact, and no confidentiality impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV); the vendor-released fix is version 4.2.0.

Denial of service in Juniper Networks Junos OS and Junos OS Evolved stems from an integer overflow/wraparound in the routing protocol daemon (rpd) OSPFv2 handling, allowing an unauthenticated adjacent attacker to disrupt or crash rpd by sending specifically crafted OSPFv2 packets onto an OSPF-enabled interface. Only devices with OSPFv2 configured and reachable at Layer 2 on the attacker's segment are exposed, which is the primary limiting factor; devices without OSPFv2 running are not affected. Scoring is CVSS 4.0 7.1 and CVSS 3.1 7.1 (AV:A/AC:L/PR:N/UI:N, availability-only impact), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected release trains.

Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an authenticated high-privilege actor who can load and execute flight sequences bypass the sequencer's stack write bounds check via a U32 integer wraparound in a STORE directive, so memcpy writes outside the sequencer stack and can cause denial of service, memory corruption, and potentially code execution. It is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) because the malicious sequence must be supplied and run - typically requiring trusted commanding, uplink, or ground-system authority - making it an access-gated risk rather than an unauthenticated mass-exploitation threat. No public exploit has been identified at time of analysis, there is no CISA KEV entry, and the vendor released a fixed version (4.2.0).

Denial of service in Juniper Networks Junos OS and Junos OS Evolved: the Layer 2 address learning daemon (l2ald) contains an integer overflow/wraparound (CWE-190) that can be triggered by a crafted EVPN Type-2 (MAC/IP) route advertisement, causing the process to fail and disrupting EVPN-based Layer 2 forwarding. Affected are devices running EVPN with an established, configured BGP peering session; the attacker must control one of those configured EVPN BGP peers, so exposure is limited to environments where EVPN is deployed and peer trust is not strictly enforced. CVSS 8.7 (CVSS 4.0) and 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat.

Crafted BGP route updates sent by an established BGP peer can trigger an integer overflow in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved, crashing the process and causing a denial of service. The flaw is only reachable when the non-default extended-nexthop-tunnel feature is explicitly enabled on the target device, and the attacker must already hold a configured BGP peering relationship with the device, meaning a trusted routing position is a prerequisite rather than anonymous internet exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor CVSS 4.0 score of 8.7 reflects high availability impact on the local system with no confidentiality or integrity exposure; note that the vendor vector lists PR:N while the vendor's own description and our assessment specify an authenticated BGP peer, a conflict that should be resolved using the description's authentication requirement.

Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker who already holds an established EVPN BGP peering relationship with a target device to disrupt the routing protocol daemon (rpd) by sending EVPN BGP routes that trigger an integer overflow or wraparound. The flaw affects EVPN-enabled routing instances and can tear down control-plane adjacencies and halt route processing, producing an availability-only impact with no confidentiality or integrity effect. EVPN is a deliberately configured, non-default feature and the peering trust relationship must pre-exist, so realistic exploitation is limited to EVPN deployments and adjacent or compromised BGP peers; no public exploit code was identified at time of analysis, and the vendor advisory is Juniper JSA112187.

Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, peer-trusted attacker to crash the routing protocol daemon (rpd) by sending specially crafted EVPN route updates. Exploitation requires an established, accepted EVPN BGP peering session with the attacker controlling or compromising the peer endpoint; routers without EVPN/BGP signaling configured or without the attacker in their accepted-peer set are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis; risk is limited to availability (no confidentiality or integrity impact), but the flaw is a genuine operational priority for networks running EVPN.

An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.

Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.

A crafted DOS (MBR) extended-partition image can trigger a 32-bit integer overflow in util-linux's libblkid partition parser before version 2.41.4, causing the library to report a bogus partition that overlaps the master boot record. An unprivileged local attacker only needs to get a malicious disk image or removable medium in front of a probing path - such as automatic udev/udisks inspection of an inserted USB device, or any tool, VM, or forensic pipeline that scans attacker-supplied images - and no public exploit code or confirmed active exploitation has been identified at time of analysis. The realistic impact is limited: libblkid's reported partition metadata is falsified (an integrity issue), while actual disk modification or availability loss would require a separate downstream consumer to trust and act on that incorrect metadata, so the practical risk is modest despite a higher CVSS base score in some feeds.

Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that triggers a heap out-of-bounds read during security descriptor decoding. The bug is an integer underflow in decode_acl: an ACL whose AclSize field is smaller than 8 bytes underflows the remaining-buffer counter, bypassing the per-ACE bounds check and producing an availability-only denial of service with no code execution, data disclosure, or integrity loss. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the attacker must either control the SMB server the victim connects to or hold a man-in-the-middle position on an unsigned SMB session (UI:P/UI:R), making this a moderate-priority availability issue rather than an emergency.

An integer overflow in list allocation inside the Nix expression evaluator - and in the Lix fork - can drive an out-of-bounds write when an attacker-supplied Nix expression is evaluated, allowing memory corruption in the evaluating process. Only Nix before 2.35.3 and Lix before 2.95.4 are affected, and the flaw is remotely reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L, base 7.5), though the high attack complexity means allocation sizes must be crafted precisely. Our assessment is consistent with a memory-corruption primitive rather than a trivial crash - high integrity impact, low availability impact, no confidentiality impact; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).

Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications that parse externally supplied media or embedded Content Credentials manifests, producing a denial-of-service condition. Affected deployments are those that invoke the SDK against untrusted input - for example services that automatically ingest and verify uploaded or fetched media - while systems that only process trusted, internally generated assets are far less exposed. The vulnerability is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no user interaction, causes availability loss only (no disclosure or modification), and no public exploit code has been identified at time of analysis; the vendor advisory is Adobe APSB26-163.

Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.

Local privilege escalation in Microsoft SQL Server allows an authenticated attacker holding low-privilege access to the instance or its host to potentially elevate privileges on the underlying system by triggering an integer overflow (CWE-190). The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0 High) confirms the attack is local rather than network-based, requires a pre-existing authenticated foothold (PR:L), and carries high attack complexity (AC:H), meaning precise conditions such as specific input sizes or memory state are needed; no public exploit identified at time of analysis, and the issue is not in CISA KEV. This is a credible but not emergency-tier privilege-escalation issue whose practical risk concentrates on multi-tenant SQL Server instances or hosts shared with low-trust principals, and vendor patches are available per the Microsoft advisory.

Integer overflow (CWE-190) in Adobe Photoshop Desktop lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Affected installations are Photoshop 27.x up to and including 27.10 and Photoshop 26.x up to and including 26.11.7, per Adobe advisory APSB26-158 (tracked as EUVD-2026-100691). The vector is local (AV:L) and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R), so there is no network-facing, no-click exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority client-side file-parsing flaw rather than a mass-exploitation emergency.

Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.

Remote code execution in Microsoft Excel is possible when a user opens a specially crafted spreadsheet, because an integer underflow (CWE-191) in Office's document handling wraps a value and leads to memory corruption exploitable for code execution in the context of the opening user. No authentication is required on the target (PR:N) and the file can be delivered over the network via email, a link, or a shared document, but exploitation depends on the victim opening the file (UI:R), and no server-side or zero-click path is indicated. Microsoft has released fixed builds (for example Office LTSC 2021 16.0.14334.20974 and Office LTSC 2024 16.0.17932.21056), and no public exploit identified at time of analysis; treat this as a high-priority, patch-worthy issue rather than an emergency given the absence of exploitation signals.

Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.

Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.

Local privilege escalation in the Windows 11 Virtualization-Based Security (VBS) Enclave allows an attacker who already holds low-privileged, authorized code execution on a host to trigger an integer overflow (CWE-190) and gain full control over confidentiality, integrity, and availability of that machine. Only unpatched Windows 11 builds 23H2, 24H2, 25H2, 26H1, and 26H2 with VBS enabled are affected; the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms a local-only, post-compromise escalation with no user interaction and no remote exposure. Vendor-released patches are available from Microsoft, and no public exploit identified at time of analysis.

Local privilege escalation in Microsoft's Windows Resource Management (MRM) component lets an authenticated attacker who already holds low-level privileges on a host trigger an integer overflow (CWE-190) and elevate to higher integrity, with full impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote - it requires an existing local foothold - but needs no user interaction and has low attack complexity, so once any code execution or interactive access is obtained on an unpatched build, escalation is straightforward. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds below the vendor's fixed revision levels are affected; there is no public exploit code identified and no confirmed active exploitation (no CISA KEV listing) at time of analysis, although vendor patches are available.

Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.

Memory corruption in Microsoft's WPF desktop stack (Microsoft.WindowsDesktop.App.Runtime, shared by .NET and .NET Framework) allows an unauthenticated, network-positioned attacker to cause an out-of-bounds write by delivering an XPS document whose glyph coordinates overflow pointer arithmetic in CD3DGlyphBank::RectFillAlpha. Exploitation requires user interaction - the victim must open or render the malicious XPS file in an affected WPF application - and prerequisites are otherwise limited to the Windows platform and to applications that actually process untrusted XPS/glyph content, so server services that never render such documents are not exposed. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact; note that signals conflict and should be weighed carefully, since the CVE description frames the outcome as privilege elevation while the vendor advisory frames it as remote code execution with process termination. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC exploitation: none), and vendor patches are available across .NET 8/9/10/11 RC, .NET Framework 3.5 and 4.x, and Visual Studio.

Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.

Local privilege escalation in the Windows HID Parser Library lets an attacker who already holds low-privileged authenticated access to a Windows host escalate to full system-level control by submitting a malformed HID report descriptor that triggers a CWE-190 integer overflow (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is local-only, requires no user interaction, and no public exploit has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', while rating technical impact as total. Because the vulnerable parser sits on the standard HID input path present in default Windows 10, Windows 11, and Windows Server configurations, the realistic risk is concentrated in multi-user, kiosk, and post-initial-compromise scenarios rather than in remote attack campaigns.

Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.

Denial of service in the Windows WLAN Service affects Windows 11 builds 23H2 through 26H2 and Windows Server 2025, where an integer underflow in the wireless networking component can be triggered by an unauthenticated attacker to exhaust or crash the service. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), no credentials or user interaction are required and the sole impact is loss of availability, with the practical gating factor being reachability of the WLAN stack rather than direct internet exposure; no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none, and vendor patches are available. CISA's SSVC also flags the issue as Automatable: yes with partial technical impact, making it a moderate-priority patching item for wireless-capable endpoints and servers.

Privilege escalation in the Windows Bluetooth A2DP audio-streaming driver allows an attacker who already holds low-privilege authorized access on a host - and who is within Bluetooth radio range - to induce an integer underflow in driver arithmetic and leverage the resulting memory-handling error to gain elevated rights, with high impact across confidentiality, integrity, and availability. The 8.0 High severity rating (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the CISA SSVC assessment of 'total' technical impact, and reflects two important constraints: the attack vector is adjacent-network only and the attacker must already have a foothold on the target, so this is not remote unauthenticated exploitation, and no user interaction is required. Microsoft has released updates through the MSRC update guide, CISA's SSVC exploitation value is 'none', and no public exploit code was identified at time of analysis. Unpatched Windows 10, Windows 11 (through 26H2), and Windows Server 2016 through 2025 builds are affected, but only hosts with Bluetooth enabled and within radio proximity of the attacker are exposed.

Local privilege escalation in Microsoft's Windows Client for NFS allows an authenticated low-privileged attacker who already has code execution on a host to elevate to higher privileges (assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8). Exploitation requires the optional 'Client for NFS' feature to be installed and reachable from the attacker's context, so default installations without that component are not affected, and there is no remote or network-facing attack path. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis; Microsoft has released fixes via its update guide (MSRC advisory for CVE-2026-70113), and the issue is tracked as CWE-190 integer overflow or wraparound.

Integer underflow in the Windows Kerberos authentication component allows a locally authenticated attacker to elevate privileges on an affected host, giving full control over confidentiality, integrity, and availability of the machine. Exploitation requires a prior foothold: the attacker must already hold a valid low-privileged local account (PR:L, AV:L), and no user interaction is needed once that access exists; the flaw is not remotely reachable and SSVC rates it non-automatable, so it cannot be driven at mass or wormable scale. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but a vendor patch is available from Microsoft and should be applied to the extensive list of affected Windows 10, Windows 11, and Windows Server builds.

Local privilege escalation in the Windows IP Over USB Service (IpOverUsbSvc) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to overflow an integer value and consequently gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. Affected builds span Windows 10 (21H2/22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2022/2025 according to the EUVD version ranges, although the vulnerable service ships with developer/SDK and device-debugging tooling rather than being enabled on default installations. Exploitation requires local access and the service to be installed and running, so the practical fleet at risk is developer and debugging workstations; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and a vendor patch is available.

Local privilege escalation in Microsoft Streaming Service on Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 allows an authenticated, low-privilege attacker who already has code execution on the host to exploit an integer wraparound and elevate privileges, with total impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is strictly local - the vector (AV:L/PR:L/UI:N) rules out remote or unauthenticated reach - and SSVC records exploitation as none with automatable set to no, so no public exploit code has been identified at time of analysis. This is a genuine patch-priority issue but not an emergency, and it matters most on multi-user, terminal-server and jump hosts where untrusted users can already run code.

Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.

Integer overflow in the Windows iSCSI implementation can lead to memory corruption and remote code execution on an affected host, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack requires user interaction: the victim host must initiate or process a connection to an attacker-controlled iSCSI target or portal so that a crafted iSCSI response reaches the vulnerable parser - no prior authentication is required (PR:N), but the victim must be using the iSCSI initiator/service path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is the reporting and advisory source (MSRC update guide). The practical limiting factor is the need for a victim to engage a hostile iSCSI endpoint, which makes this a serious, high-priority but not automatic-emergency issue.

Remote code execution in Microsoft's HEVC Video Extensions codecs allows an unauthenticated attacker to run arbitrary code on a Windows host when a victim opens or previews a maliciously crafted HEVC-encoded media file. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CVSS 8.8), no credentials are needed, but exploitation is not automatable because it hinges on user interaction (UI:R) and on the optional HEVC codec being installed - it is not present on every Windows system, though it ships preinstalled on many OEM devices, which narrows the exposed population. At time of analysis there is no KEV entry and no public exploit identified, so this is a credible, moderately high priority issue rather than a drop-everything emergency; the CWE-190 integer overflow/wraparound in Windows Codecs Library parsing corrupts memory in a way that can be turned into code execution.

Integer overflow (CWE-190) in Microsoft Word's document parsing can allow an unauthenticated, network-delivered attacker to execute code in the context of the victim by convincing them to open a specially crafted Word document. Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), and impact is confined to the user's Word process (scope unchanged). No public exploit identified at time of analysis, making this a moderately high but not top-tier priority for most organizations.

Denial of service in Windows Failover Cluster allows an unauthenticated remote attacker with network reachability to the cluster service communication interface to trigger an integer underflow (CWE-191) and disrupt cluster availability. The issue affects Windows Server systems where the Failover Clustering role or feature is installed and active; standalone Windows servers are not impacted. CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is availability-only, and no public exploit code or CISA KEV active exploitation is identified in the provided data.

An integer overflow in CvFWD, the Commvault network-forwarding daemon used across Commvault Cloud deployments, lets a low-privilege authenticated attacker on the network crash or degrade the forwarding service, producing an availability-only denial of service with no confidentiality or integrity impact. All Commvault components that ship or communicate with CvFWD are in scope - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - so risk is highest in environments where these services are reachable from broad or untrusted network segments rather than restricted management networks. The vendor classifies this as a 7.1 (CVSS 4.0) issue requiring PR:L; there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS data was not provided, so the practical near-term driver is patch hygiene rather than active exploitation.

A malicious or compromised RDP server can crash FreeRDP clients versions 3.11.0 up to but not including 3.32.0 when video redirection is enabled, due to an integer overflow in the handling of positive mapped-video coordinates. This moderate-severity denial-of-service requires the victim to connect to the attacker-controlled server and results only in client termination, with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis.

Integer overflow in Mozilla Firefox's Graphics component (CWE-190) can lead to memory corruption and potential remote code execution when a user loads a malicious web page. Affected versions are prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; exploitation requires user interaction (UI:R) and no authentication. No public exploit code has been identified, and the EPSS score is low at 0.16% (5th percentile), though the vulnerability is rated high severity (CVSS 8.8).

Unauthenticated remote attackers can read portions of device memory or cause a denial-of-service condition in Siemens APOGEE MBC/MEC and PXC, and TALON TC building controllers through the embedded web service, due to improper length validation of user-controllable input (CWE-191 integer underflow). Affected versions include APOGEE PXC Compact/Modular (BACnet) before V3.5.7 and (P2 Ethernet) before V2.8.21, TALON TC Compact/Modular (BACnet) before V3.5.7, and all versions of APOGEE MBC and MEC. No public exploit has been identified at the time of analysis; the vendor has released patches for the PXC and TALON variants, but no fix is available for MBC/MEC.

Opening a crafted S-102 bathymetric surface HDF5 file in OpenS100 through commit daaa35b can trigger a 32-bit integer overflow that under-allocates a heap buffer and lets attacker-controlled data be written out of bounds, resulting in an application crash or potential arbitrary code execution. The flaw lives in S102_VG_BathymetryCoverage::Read(), where the product of the numPointsLatitudinal and numPointsLongitudinal grid dimensions wraps around before the buffer size is computed. Exploitation is unauthenticated (PR:N) but constrained: no network-reachable path exists (local vector) and the victim must actively open a malicious file, and while publicly available exploit code exists, EPSS is low at roughly 0.20% (10th percentile), the issue is not in CISA KEV, and the overall signal is a real but low-priority issue rather than an urgent threat.

Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an unauthenticated attacker to execute arbitrary code on the GitLab server by supplying a specially crafted regular expression in a CI/CD configuration that passes insufficient regex validation; the defect is tracked as CWE-190 (integer overflow) and the vendor scores it 10.0 with scope change (S:C). Publicly available exploit code exists, referenced through HackerOne reports cited in the CVE record, but there is no CISA KEV entry and no confirmed active exploitation at time of analysis. Our independent assessment retains the same impact (C:H/I:H/A:H) but raises attack complexity to AC:H, because the vendor states the regex-validation path is reached by an unauthenticated user only 'under certain conditions' that are not detailed publicly and should be confirmed with GitLab; patched instances (19.4.2, 19.3.5, 19.2.8 or later) are not affected.

Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.

Arbitrary code execution in mp4v2 2.0.0 can be triggered when a victim or application opens a specially crafted MP4 file containing an undersized RTP ('rtp ') atom; MP4RtpAtom::ReadHntiType() performs an unchecked offset subtraction that underflows to a near-2^64 allocation size, leading to memory corruption and potential code execution. The assessed vector is local with user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so the malicious file must be parsed on the target system rather than delivered to a listening network service. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile), and the upstream fix is available as a PR/commit but no released patched version is independently confirmed.

A divide-by-zero in FreeRDP's freerdp-shadow-cli shadow server (versions before 3.32.0) allows an authenticated client to crash the process by sending a Frame Acknowledge PDU with a frame id one greater than the last frame sent, disconnecting all viewers. Exploitation requires a valid authenticated session and only affects the non-default shadow server deployment; no user interaction is needed and complexity is low. No public exploit code has been identified at time of analysis, and the impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Memory exhaustion in Perl's ExtUtils::Typemaps::STL::List before version 1.07 allows remote attackers to cause a denial of service via an empty list processed by the OUTPUT typemap, which triggers an integer underflow and a ~32 GiB allocation. This high-severity availability-only vulnerability (CVSS 7.5, C:N/I:N/A:H) requires a compiled XS module that uses the vulnerable typemap and a reachable code path with an empty list. No public exploit code has been identified at time of analysis, and the EPSS score is low (0.18%, percentile 7%).

Sandbox escape and kernel-level out-of-bounds write in the Zephyr RTOS userspace subsystem: an unprivileged user-mode thread that holds an assigned resource pool can pass a size near SIZE_MAX to the k_object_alloc_size() syscall (or the thread-stack branch via k_thread_stack_alloc()), causing an unsigned integer wrap-around in dynamic_object_create() so that a few-byte heap chunk is allocated while the object descriptor is registered under the caller's requested type. The subsequent init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a full kernel object over the truncated allocation, giving a supervisor-mode heap overflow of attacker-influenced size and content that corrupts sys_heap chunk metadata and adjacent kernel objects, and - when CONFIG_GEN_PRIV_STACKS is set - plants an attacker-influenced wild pointer as a user thread's privileged stack base. This is a local, high-priority privilege-escalation issue (CVSS 8.8, AV:L/PR:L/S:C) rather than a remotely reachable one: exploitation requires code execution as an unprivileged thread inside the CONFIG_USERSPACE sandbox on a build that also enables CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD under userspace) and that assigns a resource pool to the calling thread; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. The vendor has published a fix that rejects both overflowing computations and frees the partially built descriptor.

Malformed BSON bytes fed to the MongoDB Go Driver can trigger an integer overflow in the driver's BSON value-length handling (CWE-190) and cause a runtime panic; because an unrecovered Go panic terminates the process, an unauthenticated remote attacker who can control BSON input reaching an application's validation or value-access path can cause a denial of service. The exposure is genuine but bounded: the driver's own server-monitoring path already contains panic recovery and degrades only to a server-selection failure, and applications that wrap BSON parsing in their own recovery, or never pass untrusted BSON into the driver, are not affected. No public exploit code has been identified at time of analysis, and no EPSS score was provided in the source data.

Denial of service in MongoDB libmongocrypt occurs when KMS endpoint parsing triggers an integer underflow, causing an allocation failure that terminates the application process. This can be triggered by an authenticated user with write access to the key vault collection modifying a key document, or when an application passes a KMS endpoint containing a colon after its path or query during key creation. No public exploit code has been identified at time of analysis, and the vulnerability does not allow code execution, data disclosure, or data tampering-only a crash.

Denial of service in the Excelize Go spreadsheet library (github.com/xuri/excelize/v2 2.0.0-2.11.0 and github.com/xuri/excelize 1.1.0-1.4.1) lets an unauthenticated remote attacker terminate the calling process by supplying a crafted workbook. The ColumnNameToNumber function converts bijective base-26 column names into int64 without overflow detection, so an over-long name such as VGWQHXLSDVIKWV wraps to zero and is later used as a slice index by checkSheetR0 and xlsxWorksheet.checkRow, producing a negative index panic during worksheet normalization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), meaning availability-only impact; there is no evidence of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though the upstream fix commit and PR are public. This is a moderate-severity denial-of-service condition rather than a high-priority emergency, and it is only reachable when an application built on the vulnerable versions parses an untrusted spreadsheet.

An integer underflow in Zephyr's IEEE 802.15.4 link-layer security receive path lets any attacker within radio range drive an out-of-bounds read and in-place write of up to roughly 240 bytes into the network buffer pool. When CONFIG_NET_L2_IEEE802154_SECURITY is enabled and a security session at a level other than IEEE802154_SECURITY_LEVEL_NONE is established, a single crafted data frame whose payload is shorter than the configured authentication tag makes payload_len wrap to as large as 255, so CCM decryption reads several hundred bytes past the end of the exactly-sized receive buffer - and this happens before the tag is ever verified, so no key material, association, authentication, or user interaction is needed (CVSS 8.1, AV:A/AC:L/PR:N/UI:N). The primary impact is memory corruption and denial of service rather than information disclosure, since the out-of-bounds bytes are not attacker-chosen and the frame is dropped when tag verification fails; no public exploit code was identified at time of analysis, and exposure is limited to builds that enable this non-default, experimental security feature.

Guest-to-host code execution in VMware Workstation and Fusion 25H2 and 26H1 lets an attacker who already holds local administrative privileges inside a guest VM equipped with the VMXNET3 virtual network adapter escape the hypervisor isolation boundary and run code on the host. The flaw is an integer overflow (CWE-190) in the virtual NIC's device emulation and carries a CVSS 9.3 with Scope:Changed, placing it in the most severe class of hypervisor defects; it is not remotely reachable, since the attacker must first obtain a guest admin foothold and the target guest must use a VMXNET3 adapter. No public exploit code has been identified at time of analysis, and patched builds are available as 26H1u1 for both products.

A crafted HTTP request from an unauthenticated wireless client associated to a Captive-Portal-enabled SSID can crash the Captive Portal service on Arista Wi-Fi access points, causing a temporary denial of service until the service automatically restarts. Exploitation requires the Captive Portal feature to be explicitly enabled (non-default) and the attacker to be within wireless range; it is not reachable from the general internet. The vendor confirms remote code execution is not possible, and no public exploit code has been identified at time of analysis.

Integer overflow in the Media component of Google Chrome (all versions prior to 155.0.8059.39) allows a remote, unauthenticated attacker to corrupt memory via a crafted HTML page containing specially formed media content, with the potential to execute arbitrary code outside the browser sandbox. Exploitation is not automatic: the CVSS vector (UI:R) confirms the victim must actively load the attacker-controlled or compromised page, and Google rated this a Chromium severity of 'Low', indicating the sandbox-escape outcome is not reliably achievable and probably depends on specific memory conditions or combining this primitive with others. No public exploit code and no CISA KEV entry were identified at time of analysis; the 9.6 score reflects the scope-change metric (S:C) and high C/I/A impact rather than proven real-world exploitation, so the practical risk is lower than the headline score suggests.

An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.

Heap buffer overflow in libmikmod's Oktalyzer (.okt) loader lets a crafted module corrupt heap memory and potentially achieve code execution, because a 16-bit track-count field (numtrk = numpat * numchn) can be made to wrap while pattern data is still written for the full, unwrapped track count. Any application linked against libmikmod before 3.3.14 is affected, and exploitation requires the victim to open or otherwise process an attacker-supplied .okt file, matching the independently assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R (7.8) rather than a remotely reachable condition. No public exploit identified at time of analysis, and the 3.3.14 release rejects overflowing track counts outright.

Heap buffer overflow in libmikmod before 3.3.14 is triggered when an application linked against the library parses a crafted DSM module whose numchn and numpat header fields produce a product that overflows the 16-bit UWORD truncation in DSM_Load(), corrupting heap memory and potentially enabling code execution. The issue is local and file-based: an attacker must deliver a malicious DSM file and a victim must open or play it, so it is not a drive-by remote threat; no authentication or special privileges are required, and no public exploit has been identified at time of analysis. A vendor-released patch is available in libmikmod 3.3.14.

Local privilege escalation in Google Android 14 through 17 (including 16 QPR2) lets a low-privilege local actor trigger an integer overflow inside the NFC Type 4 Tag read/write path (rw_t4t_update_file in rw_t4t.cc) that produces an out-of-bounds write, yielding code execution in a higher-privileged context. Per the assessed vector (AV:L/AC:L/PR:L/UI:N), the attacker must already have local code execution or app presence on the device but needs no user interaction, and exploitation requires attacker-controlled NFC Type 4 Tag data to reach the reader/writer code path on an unpatched build. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the CVSS score is 7.8 and the practical constraint is the local-only attack vector, making this a genuine fleet-patching priority rather than an emergency.

Unauthenticated remote code execution in MikroTik RouterOS allows a network attacker who can reach the built-in web management service (WebFig / HTTP admin interface) to run arbitrary code as root, or to crash the device, with a single crafted request against the service's HTTP request-body handling. The defect is an integer underflow in that parsing path that is reachable before authentication, so no credentials, user interaction, or special privileges are needed on unpatched releases (RouterOS before 7.24). A vendor patch is available in 7.24, no public exploit identified at time of analysis, and the decisive real-world factor is whether the web management service is exposed to untrusted networks, since this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.

Integer underflow in Apache Thrift's C++ THeaderTransport can wrap a length or offset calculation and produce an out-of-bounds write, allowing a network attacker to crash or destabilize services that parse THeader-framed messages. The exposure is narrow: the library must be compiled as a 32-bit binary and must actually use THeaderTransport, while 64-bit builds and services relying on other transports are not affected, so the realistic outcome is denial of service rather than code execution or data disclosure. Affected releases are Apache Thrift before 0.25.0; no public exploit code has been identified at time of analysis, and the vendor's own scoring reflects availability-only impact (VA:H with no confidentiality or integrity effect).

An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database by sending PROPPATCH requests that declare a large number of XML namespaces. The flaw is a CWE-190 integer overflow; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms the attacker must be authenticated with write permissions, and impact is limited to denial of service and property database integrity, with no code execution, privilege escalation, or data disclosure. No CVSS score, EPSS probability, KEV listing, or public exploit code is present in the provided data, so there is no confirmed active exploitation and no public exploit identified at time of analysis.

An integer underflow (CWE-191) in the kernel-mode component of the NVIDIA GPU Display Driver for Windows lets a local, authenticated low-privileged user corrupt kernel memory in a way that can lead to code execution, privilege escalation, denial of service, information disclosure, or data tampering (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue affects the GeForce, RTX/Quadro/NVS and Tesla Windows driver branches and is not network-reachable, so an attacker must already be able to run code as a normal user on the host. There is no public exploit identified at time of analysis and no CISA KEV listing; the practical risk is concentrated on multi-user, VDI and cloud-GPU hosts where an unprivileged tenant shares the same machine as the vulnerable driver, while single-user desktops where the attacker must already hold a foothold face lower marginal risk.

Local privilege escalation in NVIDIA GPU Display Driver for Windows allows an authenticated attacker with low-privileged code execution to exploit an integer overflow (CWE-190) in the kernel module, potentially achieving code execution, denial of service, information disclosure, and data tampering. The flaw requires local access (AV:L) and low privileges (PR:L) with no user interaction, affecting systems with GeForce, RTX/Quadro/NVS, or Tesla drivers. No public exploit code or active exploitation has been identified at the time of analysis; the CVSS 3.1 base score is 7.8 (HIGH).

Local privilege escalation, code execution, denial of service, and information disclosure in NVIDIA GPU Display Driver on Windows and Linux stem from an integer overflow (CWE-190) in the kernel-mode layer that an unprivileged user can trigger to cause an out-of-bounds write. Exploitation requires local access with an existing low-privilege account (authenticated, PR:L) on a host with an affected GeForce, RTX/Quadro/NVS, or Tesla driver; the CVSS v3.1 base score is 7.8 (High) with a local attack vector (AV:L/AC:L/PR:L/UI:N). No public exploit code or CISA KEV entry was identified at the time of analysis, but the flaw is genuine and actionable for local privilege escalation if the vulnerable driver interface is reachable.

Integer underflow in the kernel-mode layer of NVIDIA GPU Display Driver for Windows and Linux allows a local attacker with low privileges to potentially achieve code execution, denial of service, privilege escalation, information disclosure, and data tampering. The flaw affects GeForce, RTX/Quadro/NVS, Tesla, and vGPU Manager products, and exploitation requires local access (CVSS AV:L) with no user interaction (UI:N) but low privileges (PR:L). No public exploit code has been identified at time of analysis, and there is no indication of active exploitation.

Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux allows a low-privileged local user to trigger an integer overflow in the kernel mode layer, resulting in an out-of-bounds write to GPU memory that can lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. Affected platforms include GeForce, RTX/Quadro/NVS, and Tesla drivers, with the 'Guest Driver' tag indicating that VM guests with GPU access are also in scope for guest-to-host or in-guest escalation. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 3.1 score is 7.8 (AV:L/PR:L/UI:N).

Integer overflow in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager can be triggered by a low-privileged user inside a guest VM, causing memory corruption with high confidentiality, integrity, and availability impact. The vulnerability affects vGPU deployments on Windows and Linux hosts across GeForce, RTX/Quadro/NVS, and Tesla driver branches, and successful exploitation could enable code execution, denial of service, privilege escalation, information disclosure, or data tampering. No public exploit code or active exploitation has been identified in the provided intelligence at time of analysis.

Unauthenticated denial of service in Apache WSS4J lets remote attackers exhaust server memory by sending SOAP messages that carry a specially crafted X.509 certificate: the certificate's SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF, and an integer overflow in WSS4J's DER bounds check allows the oversized allocation to pass validation, so an eleven-byte extension can trigger an approximately 2 GB allocation. Because the certificate is decoded while resolving the signature's key reference - before the message is authenticated - no credentials are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and repeated requests can drive an exposed WS-Security endpoint to OutOfMemory conditions. Affected releases are WSS4J 4.0.0 through 4.0.1, 3.0.0 through 3.0.5, and all versions before 2.4.4; impact is limited to availability, with no code execution or data disclosure path identified. No public exploit code, EPSS score, or CISA KEV entry is present in the provided data, so risk is driven by Apache's "important" severity rating and the pre-authentication nature of the flaw rather than confirmed active exploitation.

Remote, unauthenticated denial of service in WatchGuard Fireware OS: an integer underflow (CWE-191) in the IKEv2 daemon (iked) is triggered when a remote attacker sends a specially crafted encrypted IKEv2 message within a session negotiated with an AES-GCM cipher suite, causing the daemon process to crash. Affected are Fireware OS deployments that terminate IPsec/IKEv2 VPNs on an interface reachable by the attacker - most commonly the WAN interface - and that offer or negotiate AES-GCM for IKEv2; deployments that do not use AES-GCM for IKEv2 are not on the vulnerable path. The attack requires no authentication and no user interaction, but impact is confined to availability (CVSS 4.0 VA:H with VC:N/VI:N and no subsequent-system impact), with no code execution or data disclosure; no public exploit code has been identified at time of analysis and the change is not reported as confirmed actively exploited (CISA KEV) in the available intelligence.

Heap memory corruption in 32-bit builds of libexpat 2.7.2 through 2.8.5 lets remote attackers supply malicious XML that drives expat_realloc() past SIZE_MAX while computing an allocation size, yielding an undersized buffer and a subsequent heap overflow. The assessed impact is denial of service (crash or process instability) rather than confirmed code execution, consistent with the vendor vector (CVSS 4.0 8.2, AV:N/AC:H/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Exploitation is conditional: only 32-bit builds are exposed (64-bit builds do not overflow SIZE_MAX in this computation), the attacker must feed crafted XML to an application that parses it with the vulnerable library, and the input must push allocation sizes toward the maximum; no public exploit code or active exploitation has been identified at time of analysis.

Signed integer overflow in the s2 dictionary API of klauspost/compress before 1.18.7 lets an attacker crash a consuming Go process: a dictionary carrying a uvarint-encoded repeat value larger than MaxInt64 slips past repeat-index validation, and a subsequent call to Dict.Encode() converts the overflowed negative repeat value into an out-of-bounds unsafe.Pointer access that aborts the process with SIGSEGV. The issue is availability-only (C:N/I:N, A:H) on a CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, but real exposure hinges on the application - it only matters where untrusted, attacker-influenced bytes reach s2.NewDict() and the resulting dictionary is then encoded, not in ordinary compression or decompression of arbitrary data. No public exploit code and no CISA KEV entry were identified at time of analysis; the vendor-released patch is v1.18.7.

Integer overflow in NVIDIA DeepStream is reachable when crafted tensor dimensions are supplied in a YAML configuration file loaded by the inference pipeline, enabling an authenticated local attacker to cause denial of service, information disclosure, and data tampering. Exploitation requires local access and the ability to modify or supply the DeepStream pipeline YAML, consistent with the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N, so deployments that only load trusted operator-authored configurations are not exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the provided intelligence at time of analysis.

Integer overflow in GIMP's image parsing can cause memory corruption with high confidentiality, integrity, and availability impact for the user running the application. Exploitation is local and user-driven: the victim must open or import a maliciously crafted image (UI:R), and high attack complexity (AC:H) means the attacker must craft input with precise values to reliably trigger the overflow; no elevated privileges are required (PR:N), and impact is bounded to the user account (S:U). No public exploit identified at time of analysis.

Heap-based out-of-bounds write in the Esri LERC raster library 4.1.0 and earlier lets a remote, unauthenticated attacker crash an application that decodes attacker-supplied LERC imagery, resulting in a denial of service. Exploitation is possible only where a consuming application exposes a decode path for untrusted LERC input (for example imagery uploads, tile requests, or raster ingestion pipelines); the library is not a network service itself, so reachability is entirely dependent on the host application, and impact is confined to a process crash with no confirmed route to code execution or data disclosure. No public exploit code was identified at time of analysis and the issue has not been confirmed as actively exploited (CISA KEV); CVSS 3.1 scores it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact requiring no privileges or user interaction on a reachable decode path.

Remote code execution in Microsoft Outlook (Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024) can be triggered when a user opens or previews a specially crafted message, though successful exploitation depends on shaping an integer overflow into controllable memory corruption. The CVSS 3.1 base score is 7.5 with high attack complexity (AC:H), no attacker authentication (PR:N), and required user interaction (UI:R); the independent assessment characterizes the risk as constrained and non-urgent rather than an imminent threat. An official vendor patch is available, and no public exploit or active exploitation (CISA KEV) is identified in the provided data.

An integer overflow in the BSON encoder of the MongoDB Python Driver's bundled native C extension (PyMongo before 4.18.2) can cause an out-of-bounds write inside the process hosting the driver when an application encodes a single document built from an unusually large (~2 GB) caller-supplied value. Only builds that link the C extension are affected - the pure-Python BSON fallback is not - and successfully triggering it requires that a large attacker-influenced value actually reach the encoding path, so most applications are exposed only through data they already accept from untrusted sources. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the vendor has released 4.18.2 as the fixed version, and because impact is confined to the hosting application's own process, risk is best treated as a genuine but precondition-heavy memory-corruption issue.

Integer overflow in minimp3's mp3dec_skip_id3v1() tag-parsing routine allows a crafted APEv2 tag-size field inside an MP3 file to corrupt internal size arithmetic, which can lead to memory corruption in any application that decodes untrusted audio with a build at or around commit ea99364f. The CVSS vector supplied with the record is 9.8 (AV:N/AC:L/PR:N/UI:N), but our assessment lowers user interaction to UI:R: minimp3 is a passive single-header decoder library, so a victim or automated ingestion pipeline must open or feed the malicious file before the overflow is reachable, and there is no direct network attack surface in the library itself. No public exploit code has been identified at time of analysis, EPSS is low at 0.15% (3rd percentile), and the CVE is not listed in CISA KEV, so exploitation is unconfirmed and real-world risk depends on whether the consuming application processes hostile media.

Crafted MAT4 (MATLAB v4) files cause an integer overflow in libsndfile 1.2.2's mat4_read_header() parser, crashing the process and producing a denial of service. The flaw is network-reachable without authentication (CVSS 3.1 PR:N), but our assessment requires a victim to open the file or a backend service to ingest untrusted audio (UI:R); impact is limited to availability, with no code execution or data disclosure. No public exploit code and no vendor-released patch are confirmed at time of analysis.

Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels handling code, producing a local denial-of-service condition. The bug is reached only when a user opens an attacker-crafted document whose /Nums array supplies an /St (start-at) value near INT_MAX, which overflows in EngineMupdf::BuildPageLabelRec(); an independent assessment scores this as AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (base 7.5 as published, but the network/no-interaction vector is inconsistent with a desktop file-parsing flaw that needs user interaction). There is no confirmed code execution, confidentiality or integrity impact, no public exploit code identified at time of analysis, no CISA KEV listing, and EPSS is only 0.17% (5th percentile), so exploit likelihood is low.

Heap-buffer-overflow in MPack 1.1.1's Node (tree) parsing API on 32-bit platforms lets remote, unauthenticated attackers corrupt memory and crash the host application by delivering a MessagePack array32 or map32 header that declares an oversized element count. The declared count overflows the size_t arithmetic used to size an internal page allocation in mpack_tree_parse_children(), producing an undersized heap buffer that is then written past its end with mpack_node_data_t records. Exploitation is constrained to 32-bit builds that call the tree/Node API on attacker-supplied data: on 64-bit builds the overflow is effectively unreachable, and applications using only the streaming Expect/Reader API are not affected. EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; NVD scores this 9.8, while independent assessment rates it lower (C:L/I:L/A:H) because of the 32-bit-only deployment prerequisite.

Parsing a specially crafted MP4 file with Bento4 1.6.0.0 can terminate the process: an avcC or hvcC atom that declares a size smaller than the atom header causes an integer underflow in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(), wrapping the computed payload length to an enormous unsigned value that drives an invalid buffer allocation and copy. Reachability depends entirely on deployment - a service that automatically ingests untrusted MP4 uploads is remotely reachable, whereas CLI or manual usage requires an operator to open or process the file (user interaction), which is why our assessment scores this AV:L/PR:N/UI:R rather than the upstream AV:N/UI:N 7.5. Impact is limited to availability of the parsing process; there is no confidentiality or integrity effect and no code execution, and no public exploit identified at time of analysis.