Base de CVEs

CVE-2025-55647 Média · 5.5 CWE-190 15/06/2026

Integer Overflow or Wraparound em Gpac

An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVE-2026-6045 Média · 5.4 CWE-190 15/06/2026

Heap buffer overflow in EMF+ gradient brush import

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. In fixed versions the blend-point count is checked against the data actually available before allocating.

CVE-2025-14098 Alta · 7.8 CWE-190 12/06/2026

Avira antivirus engine heap buffer OOB write when scanning a malformed MS-DOS executable file

Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.

CVE-2026-11774 Alta · 7.6 CWE-190 11/06/2026

389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.

CVE-2026-34711 Alta · 7.5 CWE-190 09/06/2026

CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-47925 Média · 5.5 CWE-190 09/06/2026

Acrobat Reader | Integer Overflow or Wraparound (CWE-190)

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2023-29146 Alta · 8.2 CWE-190 09/06/2026

The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a…

The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. This leads to an integer wrap-around if the data is larger than the maximum unsigned integer value (32-bit). Attackers could create a colliding hash value for two different strings by attaching 4GB of data to a string that is less than 4GB in size.

CVE-2026-47288 Alta · 7.1 CWE-190 09/06/2026

Windows Kerberos Key Distribution Center (KDC) Remote Code Execution

Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.

CVE-2026-45593 Alta · 7.8 CWE-190 09/06/2026

Windows SDK Elevation of Privilege Vulnerability

Use after free in Windows SDK allows an authorized attacker to elevate privileges locally.

CVE-2026-45592 Alta · 7.8 CWE-190 09/06/2026

Windows Internet (wininet.dll) Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Internet (wininet.dll) allows an authorized attacker to elevate privileges locally.

CVE-2026-44812 Alta · 7.8 CWE-190 09/06/2026

Windows Graphics Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVE-2026-44803 Alta · 7.8 CWE-190 09/06/2026

Windows Graphics Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVE-2026-42974 Alta · 8.1 CWE-190 09/06/2026

Windows Performance Monitor Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.

CVE-2026-42916 Alta · 7.8 CWE-190 09/06/2026

NT OS Kernel Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-46325 Crítica · 9.8 CWE-190 09/06/2026

Erro de conversão iova-para-va no driver RDMA/rxe do kernel Linux

No kernel Linux, a seguinte vulnerabilidade foi resolvida: RDMA/rxe: Corrige a conversão iova-para-va para MRs com tamanhos de página diferentes de PAGE_SIZE A implementação atual trata incorretamente regiões de memória (MRs) com tamanhos de página diferentes do PAGE_SIZE do sistema. A questão central é que rxe_set_page() é chamada com incrementos de mr->page_size, mas a page_list armazena ponteiros struct page individuais, cada um representando PAGE_SIZE de memória. ib_sg_to_page() garante que, quando i>=1, ou a) SG[i-1].dma_end e SG[i].dma_addr são contíguos ou b) SG[i-1].dma_end e SG[i].dma_addr estão alinhados a mr->page_size. Isso leva a conversão incorreta de iova para va nos seguintes cenários: 1) page_size < PAGE_SIZE (ex.: MR: 4K, sistema: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Acesso iova = 0x181800 + 0x810 = 0x182010 VA esperado: 0x173010 (segundo SG, deslocamento 0x10) Antes da correção: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] armazena a base da página do sistema 0x170000 - VA resultante: 0x170000 + 0x10 = 0x170010 (incorreto) 2) page_size > PAGE_SIZE (ex.: MR: 64K, sistema: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Acesso iova = 0x18f800 + 0x810 = 0x190010 VA esperado: 0x170010 (segundo SG, deslocamento 0x10) Antes da correção: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] armazena a página do sistema para dma_addr 0x170000 - VA resultante: página do sistema de 0x170000 + 0x10 = 0x170010 (incorreto) Yi Zhang relatou há anos um kernel panic [1] relacionado a este defeito. Solução: 1. Substituir o xarray por um array rxe_mr_page pré-alocado para indexação sequencial (todos os índices de páginas de MR são contíguos) 2. Cada rxe_mr_page armazena tanto o struct page* quanto o deslocamento dentro da página do sistema 3. Tratar as relações entre MR page_size e PAGE_SIZE: - page_size > PAGE_SIZE: dividir as páginas do MR em múltiplas páginas do sistema - page_size <= PAGE_SIZE: armazenar o deslocamento dentro da página do sistema 4. Adicionar verificações de limites e validação de compatibilidade Isso garante a conversão correta de iova para va independentemente do tamanho de página do MR e da relação com o PAGE_SIZE do sistema, além de melhorar o desempenho por meio de acesso sequencial baseado em array. Testes em hosts com PAGE_SIZE de 4K e 64K: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] (URL do relatório original omitida nesta tradução; ver a referência NVD)

CVE-2026-41977 Média · 5.0 CWE-190 09/06/2026

Integer Overflow or Wraparound em Huawei Harmonyos

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2026-41849 Alta · 7.5 CWE-190 09/06/2026

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS). Affected versions: Spring Framework 5.3.0 through 5.3.48.

CVE-2026-48095 Alta · 8.8 CWE-190 05/06/2026

GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.

CVE-2026-10999 Média · 6.5 CWE-190 04/06/2026

Integer Overflow or Wraparound em Google Chrome

Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10924 Alta · 8.3 CWE-190 04/06/2026

Integer Overflow or Wraparound em Google Chrome

Integer overflow in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10921 Alta · 8.3 CWE-190 04/06/2026

Integer Overflow or Wraparound em Google Chrome

Integer overflow in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-49510 Média · 6.1 CWE-190 04/06/2026

Integer Overflow or Wraparound em Samsung Open Source Rlottie

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.

CVE-2026-37462 Alta · 7.5 CWE-190 03/06/2026

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp…

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

CVE-2026-45686 Alta · 7.5 CWE-190 02/06/2026

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large <bytes> values and adds the payload delimiter length without checking for overflow. A crafted request with <bytes> set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek. This issue has been patched in version 0.9.0.

CVE-2026-0095 Alta · 8.0 CWE-190 01/06/2026

Integer Overflow or Wraparound em Google Android

In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.