Integer Overflow

Financial fraud via integer overflow in QuantumNous New API (an LLM gateway and AI asset-management platform) lets a low-privileged account with a positive balance or active subscription manipulate user-controlled billing multipliers so that a computed charge wraps into account credit and can drain upstream provider funds. The flaw sits in quota settlement math (common/quota_math.go and related paths) across image, video, audio, and token-count fields, and is fixed in 1.0.0-rc.18. There is no public exploit identified at time of analysis, but the upstream fix commits and GHSA advisory publicly disclose the vulnerable code paths.

Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.

Signed integer overflow in rsync 3.1.0 through 3.4.x allows network-accessible attackers to permanently disable connection timeouts on a daemon by injecting crafted MSG_IO_TIMEOUT messages carrying zero or negative values, ultimately enabling resource exhaustion via indefinitely held daemon slots. All deployments running the rsync daemon in the affected range are exposed; the fix is confirmed in rsync 3.5.0, released as a major security update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-privilege, low-complexity network attack path makes unpatched internet-facing daemons a meaningful target.

Remote code execution via integer wraparound in PostgreSQL's fuzzystrmatch contrib module allows any authenticated database user to corrupt memory and execute arbitrary code as the operating system account running the database server. All maintained PostgreSQL branches are affected: versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE impact, low attack complexity, and network accessibility establish this as a high-priority patching target.

Integer wraparound in 32-bit builds of PostgreSQL's PL/Tcl and PL/Perl procedural language extensions enables an authenticated object creator to provoke an undersized heap allocation and perform an out-of-bounds write via a crafted function body, ultimately achieving arbitrary code execution as the OS user running the database process. PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24 across active major release branches are affected. This is a recurrence of the class of integer arithmetic flaws previously addressed by CVE-2026-6473, indicating an incomplete prior remediation; no public exploit or CISA KEV listing has been identified at time of analysis.

Integer wraparound in PostgreSQL's tsvector and tsquery full-text search functions allows an unprivileged database user to trigger an undersized heap allocation and subsequently write out-of-bounds, with potential for arbitrary code execution as the operating system user running the database process. All supported major release lines are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - and the vulnerability closely mirrors CVE-2026-6473, which addressed a similar integer overflow class in the same subsystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating with full High C/I/A impact reflects the worst-case consequence of successful exploitation.

Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).

Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a victim into opening a specially crafted malicious file, exploiting an integer overflow in the application's file parsing logic (CWE-190). The flaw yields full compromise of confidentiality, integrity, and availability within the current user's context, consistent with the CVSS 7.8 score. Adobe has released a patch in version 15.5 per advisory APSB26-94; no public exploit has been identified at time of analysis.

Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. No public exploit has been identified at time of analysis, but fixes are confirmed available in GitHub releases 3.3.12 and 5.1.11.

Remote code execution in Microsoft Office Outlook stems from an integer overflow or wraparound condition (CWE-190) that allows an unauthenticated network attacker to execute arbitrary code on a victim's system, achieving full confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R reflects low attack complexity and no authentication requirement, though exploitation is gated by a user interaction step. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the attack profile is consistent with phishing-delivered malicious email or attachment campaigns targeting Outlook users.

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.

Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.

Privilege escalation in the Windows Program Compatibility Assistant (PCA) Service, affecting a broad range of Windows 10, Windows 11, and Windows Server releases, stems from an integer underflow (CWE-191) that an authenticated local attacker can trigger to gain elevated - likely SYSTEM-level - privileges. The vulnerability requires only low-privileged local access with no user interaction, producing total confidentiality, integrity, and availability impact per the CVSS vector. SSVC assessment confirms no exploitation activity at time of analysis and no public exploit code has been identified.

Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.

Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.

Integer overflow in Vim's text-property subsystem (prior to 9.2.0841) allows a crafted file to wrap a uint16_t line-property counter from 0xffff to zero, causing prop_add_one() in src/textprop.c to copy existing text-property records into a heap allocation sized for zero entries. The resulting heap corruption can yield high-impact confidentiality, integrity, and availability consequences on the local user's process. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.1 (AV:L/AC:H) reflects meaningful risk for users who open untrusted files in Vim.

Denial of service in Red Hat JBoss Enterprise Application Platform's jboss-remoting component allows any remote unauthenticated attacker who can reach application or management ports to exhaust server memory through a crafted protocol handshake. By completing an Upgrade: jboss-remoting handshake on ports 8080, 9990, or 4447, an attacker triggers an integer overflow (CWE-190) that causes uncontrolled heap allocation, inducing OOM errors that degrade or halt request processing server-wide. No public exploit has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog.

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).

Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.

Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.

Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.

Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.

Remote code execution within the Chrome sandbox via an integer overflow in the V8 JavaScript engine affects Google Chrome prior to version 151.0.7922.109. An unauthenticated remote attacker can trigger the flaw by enticing a user to visit a specially crafted HTML page, resulting in full compromise of confidentiality, integrity, and availability within the renderer process. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, though the total technical impact and low attack complexity elevate real-world priority for patching.

Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Integer underflow in the raster Rust crate's crop() function enables remote process crash via a single crafted request. When offset_x or offset_y exceeds the source image dimension, the signed subtraction wraps to a large negative i32 in release builds; that value is then cast to usize and passed to Vec::with_capacity(), triggering an unrecoverable capacity-overflow panic that kills the host process. No active exploitation is confirmed (not in CISA KEV) and no public POC is listed, but the AV:N/AC:L/PR:N/UI:N CVSS vector indicates zero-friction denial-of-service for any application that exposes the crop() call to untrusted input.

SIP message smuggling in OpenSIPS via unsigned integer overflow in TCP Content-Length parsing enables unauthenticated remote attackers to inject arbitrary SIP messages that bypass front-end SBC and proxy security policies, inherit connection authentication context, and evade rate limiting. All OpenSIPS instances with any TCP-based transport enabled (proto_tcp, proto_tls, proto_ws, proto_wss) running versions prior to 3.6.6 or 4.0.0-rc1 are affected, with no routing-script preconditions required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires only a single malformed packet against a default TCP-enabled configuration.

Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.

Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.

Unsigned integer underflow in open62541's PubSub signature verification path enables an unauthenticated remote attacker to crash an OPC UA server with a single crafted UDP packet. Affected across versions 1.3.0-1.3.18, 1.4.0-1.4.17, and 1.5.0-1.5.5 on Windows and Linux, exploitation requires a non-default build with PubSub encryption enabled and a ReaderGroup in SIGN or SIGNANDENCRYPT mode - but demands no session, credentials, or prior authentication. Patches were released 2026-07-27 and CISA published ICS advisory ICSA-26-211-08 on 2026-07-30; proof-of-concept code is withheld at o6 Automation's request and no KEV listing is present, meaning active exploitation is not confirmed at time of analysis.

Out-of-bounds heap read in the open62541 OPC UA C library allows a remote unauthenticated attacker to disclose sensitive process memory by supplying a crafted UA_Variant whose arrayDimensions provoke an integer overflow in the dimension-product computation. The overflow makes the computed element/stride total wrap to a small value, so bounds checks pass and subsequent index math walks past the heap allocation. CVSS 4.0 is 8.7 (confidentiality-only impact); no public exploit identified at time of analysis, though it is tracked in a CISA ICS advisory (ICSA-26-211-08) given the industrial/OT exposure of OPC UA servers.

Integer overflow in the UA_Variant arrayDimensions product computation in open62541 (versions 1.3.0-1.3.18, 1.4.0-1.4.17, 1.5.0-1.5.5) enables a remote attacker to trigger an out-of-bounds heap write, with potential for denial of service or arbitrary code execution in industrial OPC UA servers and gateways. CISA coordinated disclosure as ICSA-26-211-08 on 2026-07-30, citing risk to critical manufacturing, energy, and transportation infrastructure sectors worldwide. No public exploit identified at time of analysis - PoC code exists but was withheld at o6 Automation's request; the CVE is not in CISA KEV.

Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).

Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.

Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page that triggers an integer overflow in the bundled libxml component. Google rated the flaw High severity and a vendor patch is available; there is no public exploit identified at time of analysis, and the low EPSS score (0.35%) alongside CISA SSVC 'Exploitation: none' indicates no observed exploitation yet. Because the bug is contained to the sandboxed renderer, a successful attacker would still need a separate sandbox-escape to reach the host.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).

Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.

Remote code execution in Autel MaxiCharger AC Elite Home EV chargers allows unauthenticated network attackers to run arbitrary code on the device by exploiting an integer underflow in the OCPP WebSocket message handler. The flaw stems from missing validation of user-supplied length/size data used in a buffer allocation, giving full compromise of the charger. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately through Zero Day Initiative (ZDI-26-437 / ZDI-CAN-29113).

Out-of-bounds write in the pgvector PostgreSQL extension (versions before 0.8.6) lets an authenticated database user trigger an integer wraparound during IVFFlat index construction, corrupting heap memory in the backend process and potentially achieving arbitrary code execution. The flaw is exploitable only on 32-bit systems, where size calculations in the k-means clustering routine overflow the Size type. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

An integer underflow in the MP3 decoder of ESP32-audioI2S v3.4.5 allows potential arbitrary code execution via a specially crafted MP3 file. The vulnerability, caused by unchecked bit reading operations in the MP3Decoder::GetBits() function, can lead to invalid bit manipulation, application crash, or code execution. Exploitation requires a user to open a malicious MP

Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.

Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.

Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.

Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.

Processing a maliciously crafted file on Apple operating systems can lead to arbitrary code execution due to an integer overflow vulnerability (CWE-190). Affected products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, all prior to their respective fixed versions. No public exploit code has been identified, and the EPSS score of 0.17% indicates a very low probability of near-term exploitation, though the impact could be severe.

An integer overflow vulnerability in macOS can be triggered by a malicious app to cause unexpected system termination, effectively a denial-of-service. The flaw affects macOS versions prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. Although the public CVSS score suggests critical remote code execution, the actual impact appears limited to system crashes, and there is no evidence of active exploitation or public proof-of-concept code.

Unexpected system termination in Apple macOS allows a local application to trigger an integer overflow, causing denial-of-service. Versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 are affected. The vulnerability has a low exploitation likelihood (EPSS 0.16%) and no known active exploitation or public exploit code.

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sources: CVE description, CVSS, EPSS, CPE, tags, references, ENISA data. The output must be plain text paragraphs, not arrays/objects. Let's analyze the input: - CVE-2026-64774 - Description: "An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption." - CVSS Score: 9.8, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-190 (Integer Overflow) - EPSS: 0.24%, percentile 16% (low) - Patch: Available from vendor (confirmed by description listing fixed versions) - Reported by: apple - CPE: multiple Apple products: iOS and iPadOS, macOS, tvOS, visionOS - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Integer Overflow (note "Buffer Overflow" tag but it's integer overflow leading to heap corruption, maybe buffer overflow is a result) - ENISA EUVD: affected versions listed: macOS 0 <26.6, macOS 0 <15.7.8, iOS and iPadOS 0 <26.6, macOS 0 <14.8.8, visionOS 0 <26.6, tvOS 0 <26.6. It's weird: "macOS 0 <26.6" maybe means all macOS before 26.6? But they also mention specific Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6. So the affected versions are those prior to these specific fixed versions? - References: many Apple support URLs (128066 to 128072), likely each for a product. Given the description, the integer overflow exists in some component (maybe kernel, a library) across Apple operating systems. It can be triggered remotely by an attacker, leading to unexpected application termination (DoS) or heap corruption (potentially code execution). CVSS says complete confidentiality, integrity, availability impact, but EPSS is low, KEV not mentioned. No POC mentioned. Tags include "Buffer Overflow" which might

We need to produce a JSON object with all the required fields. The input provides: CVE-2026-43780, description, CVSS vector and score, CWE, EPSS, patch info, CPEs, tags, SSVC, EUVD info, affected versions, references. We must synthesize multi-source data. The CVE is about an integer overflow in iOS, iPadOS, macOS, tvOS, visionOS, watchOS when processing maliciously crafted texture. Fixed versions are given. Key tasks: ensure every field is a plain text string, no arrays or objects. Follow all precision rules. First, product_name: "iOS and iPadOS" (since that appears in the list, but it's a multi-product vulnerability. The instruction says "If multiple products, pick the primary one." The primary might be the overarching platform? The CPEs all start with apple. The product is a set of operating systems. Since the vulnerability is across many OS, maybe pick "Apple OS" or "Apple Operating Systems"? But the rule says 1-3 words, specific product. Could be "Apple iOS/iPadOS" but that's 2 words. I'll choose "Apple OS" as a collective term. However, the description mentions "iOS and iPadOS" first, then macos, etc. The most specific product name might be "iOS" as the representative. The rule says "NOT the vendor alone", so "Apple" isn't enough. "iOS" is a product. But vulnerability affects multiple products, but we need to pick the primary one. Since the title often says "iOS and iPadOS", it's a combo. I could say "iOS and iPadOS". That's 3 words. That's acceptable. I'll go with "iOS and iPadOS". Summary: Must not copy description. Must be original synthesis using all data. Start with impact verb and product. E.g., "Processing a maliciously crafted texture on Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS may cause an integer overflow leading to unexpected app termination." But need to mention CVSS, EPSS, POC status, KEV. No KEV here, no POC mentioned. So "no public exploit identified at time of analysis". EPSS score low (0.17%, percentile 6%). So s

Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.

We need to produce a JSON with the specified fields. The input includes CVE-2026-54890. The description: Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules). It leads to excessive allocation and VM abort. Affected OTP versions: OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11. CVSS 4.0: 8.2, vector given. CVSS 3.1? Not provided, we need to assess our own. CWE-191. Tags: Denial Of Service, Integer Overflow. SSVC: Exploitation none, Automatable no, Technical Impact partial. No mention of EPSS, no KEV (KEV status not provided, presumably not). References: CNA, GitHub commit, advisory, OSV, version order. There's a diff showing the fix. So we need to synthesize. Now, let's craft each field. Product name: Erlang/OTP (OTP is the full name, "Erlang/OTP" is common). So "Erlang/OTP". Simpler: "Erlang OTP". The primary product. So "Erlang/OTP". Could be "Erlang/OTP ERTS". But to keep concise: "Erlang/OTP". Since the vulnerability is in the erts module. The description says "erlang otp erlang/otp (erts modules)". So I'll go with "Erlang/OTP". Summary: Start with impact verb and product. Remote Denial of Service? The crash is VM-level abort, causing node to abort by allocating huge memory. So "Denial of service in Erlang/OTP ERTS's ETF decoder allows remote attackers to crash the VM node." Affects versions. Not actively exploited (no KEV, SSVC exploitation: none, automatable: no, but note that crash is DoS). No mention of POC. So use: "no public exploit identified at time of analysis". The attack vector: sending a crafted ETF binary. The decoder has integer underflow. Impact: node abort, not catchable. So: "Denial of service in Erlang/OTP's External Term Format (ETF) decoder allows remote attackers to crash the Erlang VM by sending a specially crafted binary term with BIT_BINARY_EXT tag having zero length and trailing bits fields. The resul

We need to produce a JSON object with the specified fields. The input provides CVE details, CVSS, EPSS, patch info, CPE, tags, affected versions, references. We must synthesize a comprehensive analysis. Given data: - CVE-2026-64422 - Description: In the Linux kernel, net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes... (full description given) - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - EPSS: 0.23% (percentile 14%) - Patch: Available from vendor (reported by Linux) - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (two entries, same) - Tags: Buffer Overflow, Linux - ENISA EUVD ID: EUVD-2026-48966 - Affected versions (EUVD): list of Linux version ranges and patches: e.g., "Linux patch: 0" (maybe meaning from version 0?), "Linux 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf <99206ce2244f8a3ed64298d0667c9055845a5dc7" (these look like commit hashes: the first is the base, the `<` indicates before the second commit. Might be that the vulnerability was introduced in commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in commits like 99206ce2244f8a3ed64298d0667c9055845a5dc7, etc. Also specific version patches: 7.2-rc1, 7.1.4, 6.1.178, 6.12.96, 5.10.261, 6.18.39, 5.15.212, 6.6.145. And "Linux 2.6.24" as a base? Actually the intro commit might correspond to kernel 2.6.24 where tcp_reordering was introduced? Possibly. The list indicates many branches affected. The description: "bound TCP reordering sysctl writes and MTU probe sizes". Exploit: negative `net.ipv4.tcp_reordering` sysctl write wraps to large u32 value, and with `tcp_mtu_probing=2` the wrapped value can overflow size calculation causing out-of-bounds read. Fix: add bounds checks, make size_needed u64. CVSS: AV:L, AC:L, PR:L, UI:N, S:U, C:H, I:N, A:H. So local attacker with low privileges can trigger out-of-bounds read leading to high confidentiality impact (info leak) and high availability impact (likely crash? Actually H for availability, maybe denial of service). No i

We need to produce a JSON analysis for CVE-2026-64361. The input includes description, CVSS score (7.8) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, EPSS 0.22% (13th percentile), Patch available from vendor, CPE strings, tags (Buffer Overflow, Linux), and a list of affected versions from EUVD (seems to be kernel version ranges and patch versions). Also CWE is N/A. We'll synthesize across these sources. The product is Linux kernel, specifically the HFS/HFSplus file system module. The vulnerability is an integer overflow (u32 wrap) in check_and_correct_requested_length, leading to out-of-bounds read (and possibly other impacts like crash or code execution) when an underflowed length value is passed. The provided CVSS is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H – local attack, low complexity, low privileges, no user interaction, unchanged scope, high impact on confidentiality, integrity, availability. That seems consistent: local user with low privileges could trigger the bug via a crafted HFS or HFS+ file system image, potentially leading to memory corruption and privilege escalation. However, the description mentions "subsequent memmove reads ~4GB past the node buffer," which could cause a read beyond buffer, possibly leading to info disclosure or kernel panic (DoS), but for code execution, it might need additional exploitation to turn it into write or execution. The CVSS suggests high impact on all three. So it's plausible a useful primitive for an attacker. The tags: Buffer Overflow, Linux. EPSS is low (0.22%, percentile 13%) meaning likelihood of exploitation in 30 days is relatively low. KEV not mentioned, so not known to be actively exploited. No POC status explicitly given, but we might infer from EPSS not zero but low, likely no public POC at time. Patch available from vendor (Linux kernel). The description mentions fix (widening to u64). No vendor advisory link other than git.kernel.org commits. So we can confirm patch available. Now we need to pro

Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.

Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.

Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.

Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.

Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).

Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.

Sandbox escape in the Chromecast component of Google Chrome before 150.0.7871.182 lets a local attacker corrupt memory through an integer overflow (CWE-190) triggered by crafted network traffic, potentially breaking out of the renderer sandbox to gain broader access on the host. Google rated the Chromium severity High, and the CVSS score is 9.3 driven by the scope change from a sandbox escape. There is no public exploit identified at time of analysis, EPSS exploitation probability is very low (0.10%), and CISA SSVC marks exploitation as none.

Memory-corruption via integer overflow in the Audio/Video Playback component of Mozilla Firefox lets a remote attacker who serves crafted media content trigger heap corruption that can lead to arbitrary code execution in the browser process. All Firefox versions prior to 153 are affected, and the NVD-assigned CVSS 3.1 base score of 9.8 (network vector, no privileges, no user interaction) reflects a full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the score reflects potential rather than observed exploitation.

Memory corruption via integer overflow in Mozilla Firefox's ImageLib graphics component allows remote attackers to potentially achieve code execution by serving a maliciously crafted image, with the flaw resolved in Firefox 153. The CVSS 9.8 rating reflects unauthenticated network reach with high impact to confidentiality, integrity, and availability, though no public exploit has been identified and the EPSS probability of 0.13% (3rd percentile) indicates no observed exploitation activity to date. It is not listed in CISA KEV and there is no public exploit identified at time of analysis.

Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Memory-safety compromise in Mozilla's NSS (Network Security Services) cryptographic library allows remote attackers to trigger an integer overflow that leads to out-of-bounds memory access, remediated in Firefox 153 (advisory MFSA2026-68). The flaw stems from incorrect boundary conditions during size calculations in NSS Libraries code, and because NSS handles TLS/certificate and cryptographic parsing, malicious network-supplied data can reach the vulnerable path without user authentication. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating no observed weaponization despite the critical CVSS score.

Memory corruption in Mozilla Firefox's JavaScript WebAssembly engine, stemming from an integer overflow (CWE-190), can be triggered by attacker-controlled web content and was patched in Firefox 153 and Firefox ESR 140.13. Reported by Mozilla and tracked as EUVD-2026-46202/MFSA2026-68 & MFSA2026-70, the flaw carries a 9.8 CVSS rating implying potential remote code execution, though no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.15% (5th percentile).

Heap and stack memory disclosure in rsync versions prior to 3.4.3 lets a malicious sender leak process memory from a receiver by overflowing an unchecked 32-bit signed counter in the compressed-token decoder. The leaked contents can include environment variables, passwords, and heap/stack/library pointers, undermining ASLR and enabling follow-on exploitation. No public exploit is identified at time of analysis, there is no CISA KEV listing, and EPSS was not provided, so real-world exploitation should be treated as unproven but plausible.

Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipsload operation corrupt heap memory. The library incorrectly computes image dimensions, allowing an integer overflow (CWE-190) in the element/pel/line/image size calculation that produces an undersized allocation followed by an out-of-bounds write. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 8.18.1. CVSS 4.0 base score is 7.0 with high integrity and availability impact.

Memory disclosure and ASLR bypass in ProFTPD's mod_sftp SCP handler affects all releases before 1.3.9c and 1.3.10rc3, letting an authenticated low-privilege user leak server process memory into an uploaded file. By sending a crafted SCP size record of UINT64_MAX, an attacker triggers a signed integer overflow (CWE-190) that produces a ~4 GB overread, exposing libc, libcrypto, and PIE pointers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the disclosed pointers are sufficient to defeat ASLR and make co-resident memory-corruption bugs reliably exploitable.

Remote code execution in Microsoft Windows Terminal allows an unauthenticated attacker to run arbitrary code by tricking a user into interacting with malicious content that triggers an integer overflow (CWE-190). The flaw carries a CVSS 7.5 rating driven by high complexity and required user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Microsoft has released a patch through the MSRC update guide.

Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Microsoft Windows Remote Desktop Protocol allows an unauthorized, unauthenticated network attacker to run arbitrary code by triggering an integer overflow (CWE-190) in RDP processing. The flaw carries a CVSS 9.8 and affects a broad range of Windows client and server builds from Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is a modest 0.78% (52nd percentile), so risk is currently theoretical but severe if weaponized.

Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to elevate to SYSTEM by triggering an integer overflow (CWE-190) in a kernel code path. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and no EPSS or KEV data supplied.

Privilege escalation in the Windows Remote Access Service (RRAS) Infrastructure allows an authenticated attacker to elevate privileges over the network by triggering an integer overflow (CWE-190) in affected code paths. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases (2012 R2 through 2025), and Microsoft has released a patch. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-reachable EoP profile with only low privileges required makes it a meaningful patch priority.

Local code execution in Microsoft Windows Terminal (shipped on Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025) arises from an integer overflow (CWE-190) that an unauthorized attacker can trigger, but only after luring a logged-on user into interacting with malicious content. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, so this is a defense-in-depth patch rather than an emergency, though the CVSS 7.8 reflects full confidentiality, integrity, and availability impact once triggered. Microsoft has released a patch via the MSRC update guide.

Local privilege escalation in the Windows NTFS file system driver allows an authenticated low-privileged user to gain SYSTEM-level rights by triggering an integer overflow (CWE-190) during filesystem processing. It affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available from Microsoft.

Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer overflow in the file-parsing path, letting an attacker who convinces a victim to open a crafted document run arbitrary code with the victim's privileges. It affects a broad Office footprint including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the macOS editions, and SharePoint Server 2016/2019/Subscription Edition. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 7.8 CVSS and Word's ubiquity make it a routine priority patch.

Local code execution in Microsoft Excel (and the broader Office suite through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from an integer underflow (CWE-191) in Excel's file parsing, letting an attacker run arbitrary code in the context of the user who opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows no attacker privileges are needed but the victim must open the file, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

Local code execution in Microsoft Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and Office Online Server) arises from an integer overflow (CWE-190) triggered when the application parses a maliciously crafted spreadsheet. An unauthorized attacker who convinces a victim to open a booby-trapped file can run arbitrary code in the context of the current user, with full confidentiality, integrity, and availability impact per the 7.8 CVSS vector. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Local privilege escalation in Windows Active Directory across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025) allows an authenticated local attacker to elevate privileges by triggering an integer overflow (CWE-190). Successful exploitation yields high confidentiality, integrity, and availability impact, effectively enabling escalation to SYSTEM-level control on the affected host. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has issued a patch via MSRC.

Local code execution in the Microsoft Windows NTFS file-system driver lets an attacker run arbitrary code by inducing a victim to interact with a specially crafted NTFS artifact (e.g., a malicious volume, VHD, or file). The flaw stems from an integer underflow (CWE-191) and spans a broad range of Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Local privilege escalation in the Windows Web Proxy Auto-Discovery Protocol (WPAD) component lets an already-authenticated local user run code with SYSTEM-level rights by triggering an integer overflow (CWE-190). The flaw affects a broad range of Windows client and server builds, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and high triad impact make it a meaningful patch-tier issue.

Local privilege escalation in the Microsoft Windows Universal Disk Format File System driver (udfs.sys) lets an authenticated low-privileged user gain SYSTEM-level control by triggering an integer underflow (CWE-191) while parsing a malicious UDF-formatted volume. It affects a broad Windows footprint from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Currently there is no public exploit identified at time of analysis, EPSS is low (0.31%), and CISA SSVC rates exploitation as none, though the technical impact is total.

Privilege escalation in the Microsoft Windows DHCP Client service, driven by an integer underflow (CWE-191) triggered when processing DHCP traffic, lets an unauthorized network attacker gain elevated privileges with full confidentiality, integrity, and availability impact. It affects a broad Windows fleet spanning Windows 10 (1607/1809) and Windows Server 2012 through 2025, including Server Core installations. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is modest at 0.76% (51st percentile), but the vendor rates it critical (CVSS 9.8) and CISA SSVC flags it as Automatable.

Local code execution in Microsoft Defender (Microsoft Malware Protection Engine) allows an unauthorized attacker to run arbitrary code by having a maliciously crafted file processed by the scanning engine. The flaw stems from an integer overflow (CWE-190) that corrupts memory during scanning, yielding full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.

Local code execution in Microsoft Defender's Malware Protection Engine (mpengine) arises from an integer underflow (CWE-191) that a local attacker can trigger with no prior authentication but requiring user interaction, yielding high confidentiality, integrity, and availability impact. Because Defender's scanning engine runs with SYSTEM-level privileges, successful exploitation would grant full compromise of the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Microsoft has released a fix.

Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated attacker on the same network segment run arbitrary code by triggering an integer underflow (CWE-191) during multicast message processing. All supported Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1 are affected. There is no public exploit identified at time of analysis, but the CVSS 8.8 adjacent-network unauthenticated profile and Microsoft's own reporting make this a high-priority patch.

Local privilege escalation to code execution in the Windows Resilient File System (ReFS) driver affects a broad range of Windows 10/11 and Windows Server 2016 through 2025 releases, where an integer overflow (CWE-190) in filesystem processing lets an already-authenticated local user run arbitrary code in an elevated context. The CVSS 3.1 vector (AV:L/PR:L) confirms low-privileged local access is required rather than remote exploitation, and there is no public exploit identified at time of analysis. Microsoft has released a patch via MSRC.

Denial of service (and potential memory corruption) in Python Pillow before 12.3.0 arises when public image coordinate APIs - Image.paste(), Image.crop(), and Image.alpha_composite() - are handed box coordinates near the signed 32-bit integer boundary (±2**31), causing a native heap out-of-bounds write in the C imaging core. Any application that forwards untrusted coordinate values into these calls can be crashed, and the OOB write raises the theoretical prospect of heap corruption. No public exploit identified at time of analysis; the fix (integer-overflow-safe int64_t arithmetic) shipped in 12.3.0.