Integer Overflow

Integer overflow in Firefox Audio/Video component before 148. Overflow in media processing leads to incorrect memory allocations.

Integer overflow in Firefox JavaScript Standard Library before 148 leads to memory corruption through crafted JavaScript operations.

Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts a size_t to int, causing overflow that could compromise cryptographic operations.

Heap corruption in Google Chrome's V8 engine prior to version 145.0.7632.109 can be triggered through integer overflow vulnerabilities when processing malicious HTML pages. An unauthenticated attacker can exploit this by tricking users into visiting a crafted webpage, potentially achieving arbitrary code execution with high impact to confidentiality, integrity, and availability. No patch is currently available for this vulnerability.

Arbitrary code execution in DNG SDK 1.7.1 2410 and earlier stems from an integer overflow vulnerability that executes with user privileges when a victim opens a crafted file. The local attack vector requires user interaction but carries high impact across confidentiality, integrity, and availability with no patch currently available.

Arbitrary code execution in Bridge versions 15.1.3, 16.0.1 and earlier results from an integer overflow vulnerability that executes with user privileges when a victim opens a malicious file. The flaw requires user interaction but carries a high severity rating with no available patch, leaving affected systems vulnerable to immediate compromise.

Arbitrary code execution in Adobe After Effects 25.6 and earlier through an integer overflow vulnerability affecting file processing. An attacker can exploit this by crafting a malicious file that, when opened by a user, executes code with the privileges of the current user. No patch is currently available for this high-severity vulnerability.

Integer overflow in the Bytes library versions 1.2.1 through 1.11.0 allows attackers to corrupt the BytesMut capacity value, leading to out-of-bounds memory access and undefined behavior in release builds. Public exploit code exists for this vulnerability, affecting applications that depend on Bytes for buffer management. A patch is available in version 1.11.1.

Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.

An integer overflow vulnerability in yoyofr modizer before version 4.1.1 allows local attackers with user interaction to achieve high-impact compromise including confidentiality, integrity, and availability violations. The vulnerability requires local access and user interaction to trigger, enabling attackers to execute arbitrary code or cause denial of service through integer wraparound conditions. No patch is currently available for this vulnerability.

IronOS soldering iron firmware has an integer overflow vulnerability that could cause unexpected behavior in temperature control.

Integer overflow in iccDEV's ICC profile parsing (versions 2.3.1.1 and below) allows remote attackers to corrupt memory or trigger denial of service by crafting malicious profile headers with tampered tag tables or offset fields, with public exploit code available. The vulnerability can potentially enable arbitrary code execution or bypass security checks in applications using affected iccDEV libraries. Users should upgrade to version 2.3.1.2 or later to remediate this risk.

ESPHome versions 2025.9.0 through 2025.12.6 are vulnerable to a denial-of-service attack via integer overflow in the API protobuf decoder, affecting all supported microcontroller platforms (ESP32, ESP8266, RP2040, LibreTiny). Unauthenticated attackers can crash ESPHome devices by sending specially crafted packets with large field length values to bypass bounds checking when API encryption is disabled. Upgrade to version 2025.12.7 or later to remediate.

Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.

Arbitrary code execution in Microsoft Office Excel results from an integer underflow vulnerability in the Long Term Servicing Channel and Online Server editions, exploitable by local attackers with user interaction. This HIGH severity flaw (CVSS 7.8) grants full system compromise capabilities including code execution, data theft, and service disruption with no available patch.

Integer overflow in Firefox and Thunderbird's Graphics component enables sandbox escape, allowing remote attackers to execute arbitrary code with high privileges through a malicious webpage or content requiring user interaction. Affected versions include Firefox below 147, Firefox ESR below 115.32 and 140.7, and Thunderbird below 147 and 140.7. No patch is currently available.

iccDEV versions 2.3.1.1 and earlier are vulnerable to use-after-free, heap buffer overflow, and integer overflow flaws in the CIccSparseMatrix function, allowing local attackers with user interaction to achieve arbitrary code execution. The vulnerability affects all systems using vulnerable iccDEV libraries for ICC color profile processing and is resolved in version 2.3.1.2.

Integer overflow in iccDEV's CIccXmlArrayType::ParseTextCountNum() function allows local attackers with user interaction to achieve arbitrary code execution through maliciously crafted ICC color profile files. The vulnerability affects iccDEV versions 2.3.1 and below, impacting users who process untrusted color profiles. Public exploit code exists for this vulnerability, and a patch is available in version 2.3.1.1.

Windows Hyper-V Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Windows Graphics Component Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.

An integer overflow was addressed with improved input validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An integer overflow was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Windows NTFS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.

Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 30.0%.

Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.

Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 89.0%.

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Netatalk on Alpine Linux contains an unspecified vulnerability addressed by the Alpine package maintainers in version 4.4.3-r0. The nature of the flaw, affected attack surface, and impact have not been disclosed in the available intelligence - the sole data point is the vendor-issued Alpine Linux package fix. Security teams should treat this as a pending-disclosure patch event and apply the update while awaiting a full CVE write-up.

Integer underflow (CWE-191) in Netatalk, the open-source Apple Filing Protocol (AFP) server, allows a network-authenticated attacker to trigger memory corruption that may result in information disclosure, arbitrary code execution, or denial of service. The vulnerability affects versions prior to 4.4.3 and is patched in Netatalk 4.4.3 (Alpine Linux package 4.4.3-r0). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

libheif on Alpine Linux contains a vulnerability addressed in package version 1.23.0-r0. The nature of the flaw - whether memory corruption, input validation failure, or another class - is not disclosed in available intelligence at time of analysis. Alpine Linux vendor advisory confirms a fix exists, but the specific impact, affected component within libheif, and exploitability conditions are not derivable from current data.

Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.

An integer-overflow flaw (CWE-190) in Apple macOS lets an attacker who already occupies a privileged on-path network position crash or otherwise deny service to the affected system. The vulnerability is fixed in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8, so every earlier build of those three branches is exposed. There is no CISA KEV listing and no identified public exploit code, and EPSS places exploitation likelihood at roughly 0.17% (6th percentile), making this a routine patch-cycle item rather than an emergency for most fleets.

We need to produce JSON. Need include "zabrze" in risk_assessment only, lowercase, naturally. Let's analyze. CVE-2026-43788: Apple macOS Golden Gate 27? "fixed in macOS Golden Gate 27". Integer overflow CWE-190, local vector AV:L, AC:L, PR:L, UI:R, S:U, C:H/I:N/A:H. CVSS 6.6. EPSS 0.17% percentile 7%. Patch available from vendor. CPE apple:macos. Tags: Information Disclosure, Integer Overflow, Apple. EUVD affected macOS 0 <27. References: Apple support 149035, NVD. We need product_name 1-3 words: "Apple macOS" or "macOS"? Use "Apple macOS". Summary: Do not start with "A vulnerability". Start with specific impact verb and product. Something like "Processing a maliciously crafted file on Apple macOS (prior to Golden Gate 27) can trigger an integer overflow, leading to denial-of-service or potential disclosure of memory contents. The flaw requires local access and user interaction, and Apple has released a fix in macOS Golden Gate 27; EPSS is low at 0.17%, and no public exploit or KEV entry is present." Need mention actively exploited? No KEV, no POC. Use "no public exploit identified at time of analysis". Do not mention "zabrze" in summary. Technical context: integer overflow in input validation, likely parsing file format. CWE-190. CPE identifies Apple macOS all versions <27. The technology: macOS file processing subsystem, unknown exact component. Explain root cause: improper input validation leads to integer overflow, which can cause memory corruption, DoS, info disclosure. Note CPE. Risk assessment: assess real-world risk. CVSS vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H. So local, low complexity, low privileges, requires user interaction, high confidentiality and availability impact. EPSS 0.17% percentile 7% low. KEV no. POC no. SSVC? We don't have SSVC explicitly but can infer. Exploitation status: none public. Automatable? No, requires user interaction. Technical impact: partial? High C/I/A? Actually C:H, I:N, A:H. So DoS and info disclosure. Compare signal

An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.

Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may result in disclosure of process memory.

Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. There is no evidence of active exploitation or public exploit code at the time of analysis, and no vendor-listed fix version is available in the supplied intelligence.

Integer overflow in the Gravity scripting language's embedded JSON parser (gravity_json.c ≤ 0.9.7) allows remote attackers to cause heap allocation size miscalculation via crafted JSON input, resulting in an undersized buffer allocation and subsequent heap memory corruption or crash. The root flaw is a `unsigned long` truncation to 32 bits on LLP64 targets (64-bit Windows) when accumulating object key-string byte counts across a two-pass JSON parse, meaning any application embedding Gravity and feeding it attacker-controlled JSON is at risk on affected platforms. A public proof-of-concept exists at GitHub issue #447 and version 0.9.8 resolves all identified paths; no active exploitation (CISA KEV) has been recorded.

Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.

Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.

Integer overflow in msgpack-java's MessageUnpacker.skipValue() allows unauthenticated remote attackers to inject attacker-controlled data into deserialized fields by supplying a MAP32 container with an element count at or above 0x40000000. When the parser multiplies this count by 2 to traverse key-value pairs, the 32-bit result wraps, causing the cursor to halt prematurely and subsequent field reads to draw from attacker-supplied bytes rather than legitimate data. No vendor-released patch has been identified in available references; the issue is tracked at GitHub issue #1014 and disclosed by VulnCheck.

Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.

Out-of-bounds heap write in PCRE2's pcre2_convert() function on 32-bit platforms allows any attacker who can supply a large, attacker-controlled pattern string to corrupt heap memory with high integrity impact. Affected releases are all PCRE2 versions before 10.48 on architectures where size_t is 32 bits; 64-bit systems are unaffected. No public exploit has been identified at time of analysis, and the 32-bit platform constraint substantially limits the exposed surface in modern enterprise environments, though embedded Linux, IoT firmware, and legacy 32-bit deployments remain genuinely at risk.

Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.

Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.

Denial of service in rclone prior to 1.75.1 allows unauthenticated remote attackers to crash individual HTTP or WebDAV connections by sending a Range request with an offset exceeding a symlink target's length. When `--links` or `links=true` is enabled, symlinks are exposed as `.rclonelink` pseudo-objects whose content is the target path string; the `openTranslatedLink` function sliced that string using a caller-controlled offset without bounds validation, producing a deterministic Go slice-bounds panic. Go's `net/http` recovers panics per connection rather than per process, limiting impact to request-level denial of service. No public exploit has been identified and the vendor-released fix is available in version 1.75.1.

Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.

Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.

Remote Desktop Client on Windows crashes with a denial-of-service condition when a user connects to an attacker-controlled RDP server that triggers a CWE-190 integer overflow or wraparound in the client parsing logic. The flaw affects at least fifteen distinct Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and every Windows Server generation from 2016 through 2025. No active exploitation has been identified; SSVC rates exploitation as none and technical impact as partial, aligning with the availability-only CVSS profile.

Integer overflow in Microsoft SQL Server 2022 and 2025 enables an authenticated, low-privilege network attacker to crash the database service, causing a denial of service for all connected clients. The flaw (CWE-190) is triggered by crafted network input that induces an integer wraparound in SQL Server's processing logic, resulting in complete availability loss. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected versions.

Integer overflow vulnerabilities in Ollama's GGUF model decoder (versions 0.31.0-0.31.1) allow a remote attacker to crash the decoder by supplying a crafted GGUF model file containing malformed string lengths, tensor dimension counts, or array sizes. The overflow triggers in readGGUFV1String and related parsing functions in fs/ggml/gguf.go, causing Ollama to abort model loading and become temporarily unavailable. A public proof-of-concept exists (GitHub issue #17033) and a patch is available in v0.31.2-rc1; exploitation requires the target to load the malicious model file.

Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.

Integer overflow in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service condition. The vulnerability (CWE-190) is network-reachable but requires prior authentication, and its impact is limited to partial availability degradation with no confidentiality or integrity consequences. IBM has released a patch, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Integer overflow in Corosync's membership commit token processing crashes the daemon on 32-bit cluster nodes, enabling a denial-of-service attack from any adjacent network host. The CWE-190 flaw causes the length validation to be bypassed on 32-bit systems where arithmetic wraps before the bounds check is applied, resulting in an out-of-bounds memory access that kills the Corosync process. Modern 64-bit deployments of the same packages are explicitly not affected, substantially narrowing real-world exposure despite the CVSS 6.5 rating; no public exploit code or CISA KEV listing exists at time of analysis.

Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a sufficiently large JSON document to crash any linked application on 32-bit-size builds. The overflow produces an undersized heap allocation that is freed, while a subsequent copy operation continues writing through the now-dangling pointer - a use-after-free sequence that terminates the host process. No public exploit code or active exploitation has been identified; impact is confined to denial of service, and the attack is constrained to 32-bit size builds of the library.

Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions 2.14.13 through 3.32.1, enabling persistent denial of service against affected database records. The dimension count for a vector submitted with more than 65,535 elements silently wraps modulo 65,536 in a 16-bit header field, causing every subsequent read of the corrupted record to raise an exception. Applications that expose vector ingestion to untrusted users are at risk of permanent per-record data loss; no public exploit has been identified at time of analysis.

Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.

Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthenticated adjacent-network attacker to crash the daemon by sending a malformed DHCPv4 packet with an IP total length field smaller than the IP header length. The missing bounds check in ni_capture_inspect_udp_header() triggers an out-of-bounds read, causing a process crash depending on memory layout - resulting in a denial of service to network configuration. No information disclosure has been demonstrated, and no public exploit or CISA KEV listing exists at time of analysis.

Integer overflow in FFmpeg's libavfilter/vf_scale.c video scaling filter allows a remote attacker to crash the FFmpeg process by delivering a crafted video file that a user then opens or processes. Affected is FFmpeg development build N-122528-gdd2976b9e1, a git-snapshot identifier rather than a stable release. No public exploit and no active exploitation are identified at time of analysis; EPSS sits at 0.15% (4th percentile), confirming low observed exploitation probability despite the ubiquitous deployment footprint of FFmpeg.

Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.

Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.

TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.

CorvusSKK, a Windows-based SKK Japanese input method editor by Sasaki Nobuyuki, contains a signed 32-bit integer overflow (CWE-190) in its tar-format dictionary file size parsing, which can allow malicious data to be written to a dictionary file when a user opens a crafted input. All versions prior to 3.3.4 are affected; version 3.3.4 was released to address this flaw alongside a separate Lua-related vulnerability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation.

Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.

Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.

Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.

Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Integer overflow in OpenEXR's deep tiled image decoder crashes any application that opens a crafted EXR file, affecting versions 3.1.0 through 3.4.13 across all three maintained release branches. The overflow occurs in OpenEXRCore's unpack_sample_table() function during the standard exr_decoding_run path, meaning no non-default configuration is required - only that the file uses the deep tiled variant of the format. Impact is denial of service via crash (no code execution demonstrated); no public exploit code exists and this vulnerability is not listed in CISA KEV.

Infinite-loop denial of service in OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 allows an attacker to permanently hang any process that parses a crafted EXR image by triggering an integer overflow in the sample-count helper roundListSizeUp(). When UINT_MAX is passed as a sample-count value, 32-bit unsigned left-shift arithmetic wraps the accumulator to zero, producing a loop condition that never terminates. The vulnerability is reachable through public OpenEXRUtil APIs, making it exploitable wherever applications accept externally-supplied EXR files. No public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in OpenEXR 3.4.0 through 3.4.12 allows any application calling exr_start_read() on untrusted input to be unconditionally aborted by a crafted HTJ2K-compressed EXR file containing a QCD marker with lower five bits set to zero. The flaw chains two weaknesses: OpenJPH's vendored assertion-based validation calls abort() instead of returning a recoverable error, and OpenEXR's error handling wraps only its internal HT header parser, leaving downstream codestream construction calls entirely unprotected. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial triggering condition and prevalence of OpenEXR in automated rendering pipelines make this a meaningful denial-of-service risk for media production infrastructure.

Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.

Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.

Heap buffer overflow in msgpack-c through version 7.0.1 results from an integer overflow in msgpack_unpacker_expand_buffer, where unchecked size_t addition of the requested reservation size and current buffer usage wraps to near-zero on near-SIZE_MAX inputs, causing the allocator to receive a massively undersized target while the function falsely reports success to the caller. Integrations that pass attacker-controlled lengths to the msgpack_unpacker_reserve_buffer API - such as custom length-prefixed streaming transports - can trigger subsequent heap overwrites when the caller writes the full declared length into the undersized buffer. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a specific non-default integration pattern not present in msgpack-c's own internal decode paths.

TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote client to crash their own connection by sending a STUN message with a crafted body-length field value between 65520 and 65532. The integer overflow in stun_get_message_len_str() causes the framing layer to misinterpret the stream, consuming only 4-16 bytes and treating remaining data as a new message, ultimately dropping the attacking client's connection. No other clients or the server process are impacted; vendor-released patch version 4.15.0 is available and no active exploitation is confirmed.

Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.

Authenticated denial-of-service in IBM Virtualization Management Interface (VMI) allows an administrator-level attacker positioned on an adjacent network to trigger an integer overflow that crashes the VMI process. Affected firmware spans FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. While the VMI restarts automatically after a single crash, repeated exploitation can sustain a meaningful availability disruption; no public exploit or active exploitation has been identified at time of analysis.

Integer overflow (CWE-190) in IBM Power Firmware allows an attacker with service-level access to the service processor to supply a specially crafted command that leaks the contents of hardware registers that are architecturally isolated from service processor visibility. Affected firmware lines include FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80, covering IBM Power server deployments running these specific firmware versions. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.