Integer Overflow

Denial of service in FreeRDP clients before 3.31.0: a rogue or compromised RD Gateway can send a WebSocket Ping frame with a crafted 64-bit extended payload length that wraps an integer inside WinPR's Stream_EnsureRemainingCapacity, producing a double free that crashes the client while the connection is being established. Exploitation requires no credentials on the attacker's side and only a victim client that routes its session through that gateway over the WebSocket transport; the primary impact is loss of availability of the client session. Vendor-released patches are available in FreeRDP 3.31.0, and there is no public exploit code or active exploitation reported in the supplied intelligence.

Heap memory corruption in FreeRDP's server-side static virtual channel handling (all versions before 3.31.0) allows an authenticated RDP client to send channel messages larger than the expected chunk size, triggering an integer underflow that corrupts heap memory and can overwrite live pointers, potentially yielding code execution on the RDP server. Reachability is gated on the server enabling CHANNEL_OPTION_SHOW_PROTOCOL for the channel, and on the attacker already holding a valid session, so this is a post-authentication, configuration-dependent flaw rather than a pre-auth RCE. A vendor fix is available in 3.31.0 via upstream commit 40d9202, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Heap out-of-bounds write in Orthanc DICOM Server allows a low-privileged network attacker to corrupt memory by supplying a malformed PNG image, potentially enabling remote code execution or denial-of-service against medical imaging infrastructure. The root cause is a CWE-190 integer overflow in pitch and buffer-size computation during PNG decoding, reported by CISA ICS-CERT under medical advisory ICSMA-26-253-02. No public exploit code has been identified at this time, but the nature of the flaw (heap corruption via attacker-controlled image data) makes it a credible RCE candidate in clinical environments.

Denial-of-service in libp2p-rendezvous ≤0.17.1 (Rust) allows a malicious rendezvous server to crash any connecting client node by sending a discovery response containing an unbounded TTL value. The client fails to validate the TTL before computing an expiry timer, triggering a CWE-190 integer arithmetic overflow that causes a Rust process panic. A proof-of-concept gist has been published; no confirmed active exploitation has been identified at time of analysis.

Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Integer overflow in Amazon Deep Java Library's tensor buffer validation component (versions 0.13.0 through 0.36.0) enables remote unauthenticated attackers to read from adjacent process memory or crash the serving process by submitting a crafted tensor payload. The CVSS 4.0 score of 8.8 reflects a straightforward network-exploitable path requiring no authentication and no preconditions (AV:N/AC:L/PR:N/UI:N), with dual confidentiality and availability impact. Vendor-released patch 0.37.0 is available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Out-of-bounds memory reads in zstd-jni versions 1.1.1 through 1.5.7-13 allow unauthenticated remote attackers to crash the JVM or extract arbitrary frame-size data from unintended memory regions by supplying crafted Zstandard-compressed input with negative or integer-overflowing offset values. Three JNI native methods - findDirectByteBufferFrame, decompressedDirectByteBuffer, and getDirectByteBufferFrame - perform 32-bit signed bounds checks without first validating that src_offset or src_size are non-negative, allowing values near Integer.MIN_VALUE to pass the comparison and drive native code to read unmapped memory. The CVSS 4.0 score of 8.8 reflects a high availability impact (JVM termination) and limited confidentiality impact; no public exploit or KEV listing has been identified at time of analysis.

Heap out-of-bounds write in VLC Media Player 3.0.0 through 3.0.23 allows a local attacker to corrupt memory by tricking a user into opening a crafted PNG file with attacker-controlled dimensions. The root cause is a 32-bit integer overflow in AllocatePicture() where plane pitch-times-lines multiplication wraps before widening to the size_t accumulator, causing both overflow guards to pass on the already-corrupted value; aligned_alloc then reserves a small wrapped buffer while the PNG decoder writes full-dimension scanlines past its end. No public exploit has been identified at time of analysis, and EPSS indicates 0.30% exploitation probability over the next 30 days.

Sandbox-escape remote code execution in Google Chrome for Android before 153.0.8010.36 arises from an integer overflow in the GPU process, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. Fixed in the same 153.0.8010.36 Stable Channel release that addressed several other GPU/media memory-safety bugs; no public exploit identified at time of analysis. Note the rating tension: the input CVSS is 9.6 (Critical) while Google's own Chromium severity is only Medium.

Integer overflow in Adobe Acrobat Reader and Acrobat (all editions through 26.002.21900) and Acrobat 2024 (through 24.001.30383) enables arbitrary code execution within the context of the victim's user account. The flaw is triggered when a user opens a specially crafted PDF file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, but the high CIA impact and wide deployment footprint make patching a priority.

Integer overflow in Adobe Photoshop Desktop enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. Both the Photoshop 2026 (≤27.6) and Photoshop 2025 (≤26.11.6) release lines are affected. No public exploit code or active exploitation has been identified at time of analysis, but the file-open attack surface is a historically well-worn delivery mechanism for creative-software exploits.

Integer overflow in Adobe Photoshop Desktop's file-parsing logic allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Affected versions span both Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6), covering a broad installed base of creative and enterprise users. No public exploit code or active exploitation has been identified at time of analysis; Adobe has published a fix under advisory APSB26-130.

Integer overflow in Adobe Photoshop Desktop (versions 2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the authenticated user. The flaw is triggered during parsing of a specially crafted file - a social-engineering delivery step is required, as the victim must open the malicious file. Adobe has issued advisory APSB26-130 addressing both affected release lines; no public exploit or CISA KEV listing has been identified at time of analysis.

Integer overflow in Adobe Photoshop Desktop (2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. The attack vector is local (AV:L) with mandatory user interaction (UI:R), making social engineering - phishing with a weaponized design file - the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad and Adobe PSIRT attribution confirm this is a serious file-parsing flaw covered under advisory APSB26-130.

Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.

Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.

Integer overflow in Microsoft Excel's file parsing engine allows an unauthenticated attacker who delivers a specially crafted Excel workbook to execute arbitrary code with the privileges of the victim user upon file opening. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC variants on both Windows and macOS. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected product lines.

Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.

Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.

Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.

Privilege escalation to SYSTEM in Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to fully compromise the affected Windows host via an integer overflow (CWE-190) in the biometric framework's internal processing. The flaw spans a broad surface of Microsoft Windows client and server editions from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.

Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution is possible in Microsoft Office Publisher across multiple Office suite versions when a victim opens a maliciously crafted Publisher document. The root cause is an integer overflow or wraparound (CWE-190) in the file-parsing subsystem, which typically produces an understated buffer allocation that an attacker can exploit to corrupt heap memory and redirect execution. Affected releases span Publisher 2016 through Microsoft 365 Apps for Enterprise; vendor-released patches are available for all affected versions, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.

Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.

Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.

Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.

Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.

Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.

Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.

Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.

Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.

Denial-of-service via integer overflow in Microsoft SQL Server allows unauthenticated remote attackers to crash the database service over a network connection. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and GDR branches. Microsoft has released patches; no public exploit code or active exploitation has been identified at time of analysis.

MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.

Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.

Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.

Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.

Remote denial of service in OpenVPN's reliability layer - the custom reliable-delivery sublayer underpinning the TLS control channel - allows unauthenticated network attackers to crash or hang OpenVPN daemons on versions up to 2.7.6 and 2.6.22 by triggering an unbounded TLS retransmission timeout or forcing acknowledgment of packets that cannot be outstanding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms full availability impact with no authentication, complexity, or user-interaction requirements, and downstream VPN clients lose connectivity when the concentrator is taken offline. No public exploit code or active exploitation (KEV) has been identified at time of analysis; vendor-released fix is available as OpenVPN v2.7.7.

Integer overflow in Signum Node's block processing engine prior to v3.9.9 allows a malicious miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The flaw exists in BlockServiceImpl.applyBlock() and was introduced when the SMART_FEES hardfork (at block ~1,029,000) added fee cash-back and burn accounting logic without overflow guards. No public exploit code has been identified at time of analysis, but the attack is technically feasible for any active network participant with mining capability.

The BEAM runtime in Erlang/OTP crashes when a remote attacker sends a crafted packet to any exposed TCP port using the inet driver with {packet,4} framing, exploiting a signed integer overflow in packet length calculation inside packet_parser.c and inet_drv.c. Affected deployments span OTP release lines 17 through 29, with vendor-released patches available (27.3.4.17, 28.5.0.6, and 29.0.6); no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis. The vendor explicitly characterizes remote code execution as 'extremely unfeasible,' making denial-of-service via VM crash the realistic worst-case impact.

Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Memory corruption in the Graphics: ImageLib component of Mozilla Firefox stems from an integer overflow when handling image data, potentially allowing remote attackers to corrupt heap memory and achieve code execution when a victim renders malicious image content. Mozilla fixed the issue in Firefox 155 and Firefox ESR 153.2 (advisories mfsa2026-82/85/86/88). It carries a critical 9.8 CVSS score, but EPSS is only 0.14% (4th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.

Integer overflow in MSI Dragon Center's NTIOLib_X64.sys kernel-mode driver (versions up to 2.0.155.0) allows local low-privileged users to corrupt kernel memory via crafted count or elementSize arguments passed to the MmioWritePath MMIO Write Path Handler. Exploitation can yield full SYSTEM-level privilege escalation on the target host. A public proof-of-concept is available, the vendor did not respond to coordinated disclosure, and no official patch has been released.

Integer overflow in Klever-Go's semi-fungible token (SFT) add-quantity path prior to version 1.7.19 allows a mint-role holder to bypass a finite per-nonce MaxSupply constraint, minting approximately 9.2×10^18 tokens in a single transaction. The SFTAddCirculation function in core/kapp/systemAccount/systemAcount.go increments Circulation before checking the cap, enabling an int64 wraparound that makes the MaxSupply comparison permanently false. A proof-of-concept unit test is included in GHSA-mrpp-v6pg-p54x confirming the bypass; no CISA KEV listing is present at time of analysis.

Unbounded native-token (KLV) minting in the Klever blockchain node (klever-go < 1.7.19) lets any funded account inflate the ledger at will. Split-royalty percentages on a KDA asset are validated by summing per-entry values into a uint32 accumulator with no per-entry cap, so two entries near 0x80000000 wrap the sum below the 10000 (100%) limit and pass validation while each stored percentage stays astronomically large; at payout every split recipient is credited pool × hugePct / 10000 and the negative remainder is silently dropped, minting KLV out of thin air. A full working proof-of-concept is published in the GitHub Security Advisory (GHSA-cgc5-v3f2-8m2v); it is not in CISA KEV and no EPSS score was provided, but the flaw is exploitable on current mainnet and not gated by any fork flag.

Ledger value-creation (KLV minting) in Klever's marketplace settlement affects the klever-go node prior to v1.7.19: because referral and royalty cuts are paid in full while a negative seller remainder is silently dropped, any funded account can settle a self-dealt order whose referral% + royalty% exceeds 100% and mint the surplus into attacker-controlled addresses. Exploitation requires only an ordinary account (PR:L) reachable over the public transaction RPC (CVSS 9.6). Committed regression-test exploit code exists, and the vendor advisory (GHSA-p7gw-2pcp-5pf8) and community monitoring document active mainnet exploitation that minted tens of millions of KLV before an emergency guard was deployed, though this CVE is not listed in CISA KEV.

Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to abort the client process during fetch operations by sending a crafted side-band packet line with an empty payload. The TextRef implementation fails to handle zero-length payloads, triggering an unconditional Rust panic that terminates the connecting client. No authentication is required on the attacker's side; the victim need only initiate a fetch or clone against a hostile server. No public exploit code or CISA KEV listing identified at time of analysis.

Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN session negotiation. By sending specially crafted network packets to the IKE service, an attacker can trigger an integer underflow in iked, crashing VPN processing and disrupting all VPN-dependent connectivity without any authentication. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.

Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic. The flaw (CWE-191) resides in the IKEv1/IKEv2 key exchange handler, meaning any internet-exposed WatchGuard appliance with VPN enabled is reachable from the network perimeter without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack vector and availability impact of 8.7 (CVSS 4.0) make this a meaningful risk for organizations relying on WatchGuard VPN for remote access continuity.

Integer overflow in FFmpeg's libswscale library allows any application or service processing attacker-controlled image files to be crashed via a specially crafted input, causing a Denial of Service. The vulnerable function hScale16To19_c() in output.c is affected in build N-122528-gdd2976b9e1; the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects worst-case exposure in automated media-processing services. Despite the high CVSS score of 7.5, the EPSS probability is just 0.15% at the 4th percentile and no active exploitation has been confirmed, indicating limited real-world exploitation activity at time of analysis.

Integer overflow in the open5gs 2.7.6 NRF (Network Repository Function) discovery endpoint enables remote unauthenticated denial of service. Sending a crafted HTTP/2 GET request to /nnrf-disc/v1/nf-instances triggers arithmetic overflow that crashes the NRF service, disrupting 5G network function discovery for all dependent core network components. No public exploit has been identified and EPSS at 0.18% (7th percentile) reflects low current exploitation interest, though the unauthenticated network vector lowers the bar for any attacker with access to the SBI interface.

Integer overflow in FFmpeg's libswscale/output.c (yuv2planeX_8_c function) allows a remote attacker to crash the FFmpeg process by supplying a crafted video file, causing denial of service in any pipeline that processes untrusted media. The affected build is development snapshot N-122528-gdd2976b9e1; stable release exposure is unconfirmed. No public exploit code and no CISA KEV listing exist; EPSS of 0.15% (4th percentile) indicates very low near-term exploitation probability despite the high CVSS base score.

Integer overflow in FFmpeg's libswscale image-scaling library (output.c) enables Denial of Service against any service or application that processes attacker-supplied media through the swscale API. The flaw, confirmed in snapshot build N-122528-gdd2976b9e1, resides in the target_sws_fuzzer() harness and indicates that the underlying scaling output path contains an integer wraparound reachable via crafted input. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS probability is negligible at 0.15%, suggesting minimal current threat actor interest.

Integer overflow in Open5GS v2.7.6's Session Management Function (SMF) allows remote unauthenticated attackers to crash the service via a crafted GTP packet, causing Denial of Service against 5G core network infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms zero-authentication network exploitation requiring no user interaction. Researcher-published proof-of-concept code exists in a public GitHub repository and gist, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

Integer overflow in FFmpeg's libswscale/utils.c component, present in development snapshot N-122528-gdd2976b9e1, allows unauthenticated remote attackers to crash any application relying on that component for image scaling by supplying a specially crafted image file. The CVSS 7.5 High rating reflects a network-reachable, zero-authentication denial-of-service path, but the EPSS score of 0.15% at the 4th percentile indicates negligible observed exploitation activity. No public exploit code and no CISA KEV listing are confirmed at time of analysis.

Arbitrary code execution in libtiff's thumbnail command-line tool (commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938) allows local attackers to achieve full system compromise through a CWE-190 integer overflow in the main() function of libtiff/tools/thumbnail.c. When a crafted TIFF file triggers the wraparound, memory corruption can enable attacker-controlled code execution with the privileges of the invoking process. No public exploit is confirmed at time of analysis, and EPSS probability is very low (0.17%, 6th percentile), indicating limited real-world exploitation risk despite the high CVSS base score of 8.4.

Integer overflow (CWE-190) in Chromium's file-processing code exposes all desktop Google Chrome versions prior to 152.0.7977.65 to in-sandbox memory disclosure when a user opens a specially crafted file, requiring no authentication (PR:N) but requiring user interaction (UI:R). A critical data conflict across sources warrants attention: the NVD CVSS score is 8.8 with C:H/I:H/A:H, yet Google's Chromium team rates this Low severity, and the EPSS is 0.16% (5th percentile) with SSVC Exploitation:none - collectively suggesting the attack impact is bounded to memory readable within the sandboxed renderer, without sandbox escape. No public exploit identified at time of analysis.

Integer overflow in the WebRTC component of Google Chrome prior to 152.0.7977.65 enables remote code execution confined to the browser's sandbox via a crafted HTML page. The flaw requires no authentication (PR:N) and no special browser configuration, as WebRTC is enabled by default, but it does require the victim to visit an attacker-controlled page (UI:R). No public exploit code has been identified and EPSS places exploitation probability at 0.35%, consistent with SSVC's assessment of no current exploitation; notably, Google's own internal Chromium severity rating for this issue is 'Low,' suggesting the sandbox boundary and exploit reliability considerations factor into their triage.

Remote code execution outside the browser sandbox is potentially achievable in Google Chrome versions prior to 152.0.7977.65 through an integer overflow in the WebGL graphics subsystem triggered by visiting a crafted HTML page. The vulnerability affects all Chrome desktop platforms with a high-impact CVSS score of 8.8, though Chromium's internal severity rating of Medium and a low EPSS score of 0.25% (16th percentile) together suggest real-world exploitation remains uncommon at time of analysis. No public exploit code and no confirmed active exploitation have been identified; a vendor-released patch is available in stable channel update 152.0.7977.65.

Integer overflow in the Chromecast component of Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to escape the browser sandbox and execute arbitrary code on the underlying operating system via a crafted HTML page. The CVSS score of 8.3 reflects the full scope change (S:C) and complete confidentiality, integrity, and availability impact once the sandbox boundary is crossed, while AC:H acknowledges the mandatory pre-existing renderer compromise required to reach the vulnerable code path. No public exploit has been identified at time of analysis, and EPSS stands at a low 0.30% (22nd percentile), consistent with the elevated exploitation complexity of this chained-attack vulnerability.

Out-of-bounds pointer arithmetic in OpenEXR's TypedDeepImageChannel::row() - and parallel methods in FlatImageChannel and SampleCountChannel - affects all releases before 3.2.11, 3.3.13, and 3.4.14, exposing applications that process deep EXR files with nonzero dataWindow origins to deterministic crash or limited heap memory disclosure. The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R) reflects unauthenticated, low-complexity delivery of a crafted image file requiring only that a user or pipeline opens it, with high availability impact and limited confidentiality exposure. No CISA KEV listing and no public exploit code have been identified at time of analysis; patched releases are available from the Academy Software Foundation.

Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.

Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.

Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.

Remote denial-of-service and potential information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arises from an integer underflow (CWE-190 class) reachable over the network without authentication. An unauthenticated remote attacker can send crafted input that triggers the arithmetic wraparound, crashing an affected service and possibly reading sensitive memory contents. There is no public exploit identified at time of analysis, EPSS is low (0.51%, 41st percentile), and it is not on CISA KEV.

Remote code execution in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, arises from an integer overflow (CWE-190) during a size computation that a remote attacker can trigger to run arbitrary code. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation with no user interaction, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximal CVSS and RCE nature make this a top-priority patch for affected Power/AIX estates.

Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers via an integer overflow (CWE-190) in a network-reachable component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication and no special configuration, making all internet- or network-exposed instances directly at risk. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.

Heap buffer overflow in hank-ai/darknet's convolutional layer initialization corrupts process memory when a crafted .cfg model configuration is loaded, because layer weight and output buffer sizes are derived from unchecked 32-bit integer multiplication of configuration-supplied fields, allowing the product to wrap to zero or a small value. Darknet versions through 6.0 are affected, and no valid .weights file is required to trigger the flaw - the .cfg alone is sufficient. A publicly available proof of concept demonstrates both an out-of-bounds read under AddressSanitizer and glibc allocator metadata corruption in a release build, confirming that exploitation does not require deep reverse engineering.

Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.

Remote code execution in GIMP 3.2.2 is achievable when a user opens a crafted APNG file, triggering an integer overflow before buffer allocation in the APNG parser (CWE-190). Disclosed by Zero Day Initiative as ZDI-CAN-29401/ZDI-26-462 and tracked as EUVD-2026-63458, the flaw yields full C/I/A compromise within the GIMP process. No active exploitation is confirmed (not listed in CISA KEV), but a fix commit is available on GNOME GitLab; no officially tagged patched release has been independently confirmed at time of analysis.

Remote code execution in GIMP 3.2.2 is achievable via a specially crafted TIF image file that triggers an integer overflow in the application's TIFF parser, causing an undersized heap allocation and subsequent memory corruption. An attacker who convinces a user to open a malicious file or visit an attacker-controlled page that delivers such a file can execute arbitrary code with the privileges of the victim's user account. No public exploit identified at time of analysis, though the ZDI origin (ZDI-26-461, formerly ZDI-CAN-29405) represents a technically verified, researcher-confirmed vulnerability with well-characterized root cause.

Remote code execution is possible in GIMP 3.2.2 through a maliciously crafted SGI image file, exploiting an integer overflow in the application's SGI file parser. An unauthenticated remote attacker can deliver the file via email or web and, upon the victim opening it, execute arbitrary code within the GIMP process context with the privileges of the logged-in user. No active exploitation has been confirmed (not in CISA KEV), though ZDI's coordinated public disclosure via ZDI-26-459 lowers the barrier to weaponization; an upstream patch commit exists but a formally tagged fixed release has not been independently confirmed.

Remote code execution in GIMP 3.2.2 is achievable by an attacker who can convince a target user to open a specially crafted TIF file, triggering an integer overflow during buffer allocation in the TIFF parser that leads to heap corruption and arbitrary code execution in the context of the current user process. Disclosed by the Zero Day Initiative under ZDI-26-458 (ZDI-CAN-29406), the flaw is rooted in missing validation of user-supplied size data before heap allocation. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog; however, an upstream fix commit is available in the GIMP GitLab repository.

Remote code execution via maliciously crafted TIF files affects GIMP 3.2.2, allowing an attacker to execute arbitrary code in the context of the running GIMP process with full user-level privileges. The root cause is a CWE-190 integer overflow in the TIFF file parser where attacker-supplied image metadata bypasses size validation before a heap allocation, enabling memory corruption and code execution. Reported by Zero Day Initiative as ZDI-CAN-29403 and tracked under ENISA EUVD-2026-63453; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in GIMP 3.2.2 is triggered when a victim opens a specially crafted PSD file, exploiting an integer overflow in the PSD parser that occurs before buffer allocation. Tracked by Zero Day Initiative as ZDI-CAN-29395 and rated CVSS 7.8, the flaw allows an unauthenticated remote attacker to execute arbitrary code within the GIMP process context after inducing the target to open a malicious file. No public exploit identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.

Remote code execution in GIMP 3.2.2 is possible when a user opens a specially crafted HDR image file, with the underlying flaw residing in the GEGL image processing library that GIMP depends on. The integer overflow in HDR buffer size computation (CWE-190) produces an undersized heap allocation that an attacker can leverage to execute arbitrary code in the context of the victim's GIMP process. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed; the ZDI advisory (ZDI-26-453) assigns this a High severity rating of CVSS 7.8.

Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.

Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.

Remote code execution in IBM AIX 7.2 and 7.3, and in the IBM PowerVM VIOS 4.1 virtualization stack, stems from an integer overflow (CWE-190) that a network-based attacker can trigger without authentication or user interaction. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was supplied in the input.

IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.

Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.

Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. No public exploit or CISA KEV listing exists at time of analysis; however, the combination of complete C/I/A impact and scope change makes this a high-priority patch target for any organization running affected IBM Power hardware.

Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.

Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.

Out-of-bounds kernel heap read and write in FreeBSD's semctl(2) GETALL and SETALL commands enable local privilege escalation by exploiting a 15-bit sequence-number wraparound in the System V semaphore subsystem. FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2 are affected. An unprivileged local attacker races two processes - one cycling semaphore set destruction and recreation to wrap the 0x8000-bounded counter, another issuing GETALL or SETALL at the moment of wrap - causing the kernel to copy semaphore values using a mismatched buffer size and producing exploitable heap corruption. No public exploit code has been identified at time of analysis, but the vulnerability class (local kernel heap OOB via IPC race) is a consistently weaponized primitive for privilege escalation.

Heap buffer overflow in the baresip 'libre' real-time communications library (versions prior to 4.8.1) lets remote attackers corrupt heap memory or crash any application running a WebSocket server via websock_accept()/websock_accept_proto(). The websock_decode() function miscalculates frame bounds for 64-bit extended-length masked frames, and the out-of-bounds XOR unmasking write is attacker-controlled. No public exploit identified at time of analysis, but the flaw is network-reachable and unauthenticated per the CVSS vector.

Integer overflow in Dragonfly's Count-Min Sketch implementation prior to v1.40.0 allows unauthenticated remote clients to corrupt adjacent heap memory, partially disclose heap contents, and crash the server. The flaw exists in src/core/cms.cc: CMS.INITBYDIM and CMS.INITBYPROB accept width/depth parameters whose product with sizeof(int64_t) overflows size_t, causing the allocator to receive a truncated length and produce an undersized buffer; CMS.INCRBY and CMS.QUERY then operate with the original large dimensions, writing and reading past the end of that buffer. No public exploit code has been identified at time of analysis, but the CVSS 4.0 vector confirms unauthenticated network exploitation with no preconditions, rating this 8.8.

Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.