Base de CVEs

CVE-2026-48298 Média · 6.2 CWE-191 14/07/2026

CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-48296 Média · 6.2 CWE-191 14/07/2026

CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-55011 Alta · 7.8 CWE-191 14/07/2026

Microsoft Defender Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.

CVE-2026-54982 Alta · 8.8 CWE-191 14/07/2026

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-49181 Crítica · 9.8 CWE-191 14/07/2026

Windows DHCP Client Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-51540 Crítica · 9.8 CWE-191 13/07/2026

Integer Underflow em Opener Project Opener

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

CVE-2026-29008 Alta · 7.5 CWE-191 08/07/2026

U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.

CVE-2026-55490 Média · 6.5 CWE-191 07/07/2026

OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service

OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5.

CVE-2026-58016 Crítica · 9.1 CWE-191 30/06/2026

GLib: leitura fora dos limites via XML de introspecção D-Bus malformado

Foi encontrada uma falha no GLib. Um problema de confusão de estado existe em g_dbus_node_info_new_for_xml() no arquivo gio/gdbusintrospection.c ao processar XML de introspecção D-Bus malformado, especificamente com um elemento node aninhado dentro de outros elementos como method, signal, property ou arg. Esse problema pode causar um estouro de inteiro sem sinal e levar a uma leitura fora dos limites, resultando em negação de serviço.

CVE-2026-58058 Média · 6.5 Exploit público CWE-191 27/06/2026

Nmap - Integer Underflow in IPv6 Extension Header Parsing

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

CVE-2026-57918 Alta · 7.1 CWE-191 26/06/2026

Integer Underflow em Sahlberg Libnfs

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.

CVE-2026-6678 Média · 5.3 CWE-191 25/06/2026

Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info

Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.

CVE-2026-53178 Alta · 8.1 CWE-191 25/06/2026

staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Add guards to ensure ie_length is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow.

CVE-2026-53176 Crítica · 9.8 CWE-191 25/06/2026

Underflow de inteiro no tratamento de PDU de login iSER (isert) do kernel Linux

No kernel Linux, a seguinte vulnerabilidade foi resolvida: IB/isert: Rejeitar PDUs de login menores que ISER_HEADERS_LEN Em drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() calcula o tamanho da carga útil da requisição de login como wc->byte_len menos ISER_HEADERS_LEN, sem limite inferior, e login_req_len é um int com sinal. Um iniciador iSER remoto pode postar um work request de Send de login transportando menos de ISER_HEADERS_LEN (76) bytes, de modo que a subtração sofre underflow e login_req_len torna-se negativo. isert_rx_login_req() então lê esse tamanho negativo de volta para um int com sinal, calcula size = min(rx_buflen, MAX_KEY_VALUE_PAIRS) e, como o min() é com sinal, mantém o valor negativo; o valor é então passado como o tamanho do memcpy() e estendido com sinal para um size_t de vários gigabytes. A cópia para o login->req_buf de 8192 bytes ultrapassa muito os limites e causa falha, derrubando o nó alvo. A fase de login precede a autenticação iSCSI, portanto nenhuma credencial é necessária para alcançar esse caminho. Rejeitar qualquer PDU de login menor que ISER_HEADERS_LEN antes da subtração, espelhando o retorno antecipado existente em caso de falha do work completion, de modo que login_req_len nunca possa ser negativo. O limite superior já era seguro: um buffer de login postado não pode entregar mais que ISER_RX_PAYLOAD_SIZE, então a diferença permanece em ou abaixo de MAX_KEY_VALUE_PAIRS e o min() existente a limita; apenas o limite inferior ausente precisava ser adicionado.

CVE-2026-53150 Média · 5.5 CWE-191 25/06/2026

thunderbolt: Reject zero-length property entries in validator

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol.

CVE-2026-53130 Alta · 7.8 CWE-191 24/06/2026

fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

CVE-2026-52919 Alta · 7.8 CWE-191 24/06/2026

batman-adv: fix tp_meter counter underflow during shutdown

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counter underflow during shutdown batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending", a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active. Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once. [sven: added missing change in batadv_tp_send]

CVE-2026-30803 Crítica · 9.1 CWE-191 17/06/2026

Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.

Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers. This issue affects Connext Micro: from 4.0.0 before 4.3.0.

CVE-2026-11850 Média · 5.0 CWE-191 11/06/2026

Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.

CVE-2026-42542 Alta · 7.5 CWE-191 10/06/2026

TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)

TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue.

CVE-2026-42981 Alta · 8.1 CWE-191 09/06/2026

Windows Performance Monitor Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.

CVE-2026-11789 Média · 6.5 CWE-191 09/06/2026

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication.

CVE-2026-49494 Alta · 7.5 CWE-191 07/06/2026

Xcitium Client Security / Comodo Internet Security Remote Denial of Service

Xcitium Client Security (XCS) before 13.8.2.10019 and Comodo Internet Security (CIS) through 12.3.4.8162 (fix expected by 2026 Q3) contain an integer underflow vulnerability in the firewall driver Inspect.sys that allows remote unauthenticated attackers to crash the system by sending a crafted IPv6 packet with a declared payload length smaller than the sum of its extension-header lengths. The unsigned 64-bit payload-length value underflows to a near-maximal integer, triggering an out-of-bounds read and oversized memcpy in the Windows kernel at DISPATCH_LEVEL, resulting in a blue screen of death even on hosts with all ports blocked.

CVE-2026-50593 Alta · 7.3 CWE-191 05/06/2026

Integer Underflow em Graphite project Graphite

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

CVE-2026-37231 Alta · 7.5 CWE-191 01/06/2026

Integer Underflow em Mosaic5g Flexric

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID in its internal data structure. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.