CVE Database

CVE-2026-106417 Critical · 9.6 CWE-190 Oct 6, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106332 Medium · 4.3 CWE-190 Oct 6, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106239 Critical · 9.6 CWE-190 Oct 6, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-105839 High · 7.8 CWE-190 Oct 6, 2026

libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution.

CVE-2026-105837 High · 7.8 CWE-190 Oct 6, 2026

libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.

CVE-2026-75820 Low · 1.8 CWE-190 Oct 6, 2026

Integer Truncation Leading to Heap Corruption in GNU Aspell

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service. This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.

CVE-2026-49885 High · 7.8 CWE-190 Oct 5, 2026

Integer Overflow or Wraparound in Google Android

In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-20533 Medium · 6.7 CWE-190 Oct 4, 2026

Integer Overflow or Wraparound in Mediatek Mt6739 Firmware

In display, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11296678; Issue ID: MSV-9167.

CVE-2026-79113 Medium · 5.1 CWE-190 Oct 2, 2026

Integer Overflow or Wraparound in Aswf OpenAPV

OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow.

CVE-2026-103629 Medium · 4.3 CWE-190 Oct 2, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-103621 Medium · 4.3 CWE-190 Oct 2, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-93546 High · 8.8 CWE-190 Oct 1, 2026

Apache HTTP Server: mod_dav_fs namespace overflow

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

CVE-2026-102504 High · 7.5 CWE-190 Oct 1, 2026

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.

CVE-2026-47577 High · 7.8 CWE-190 Sep 30, 2026

Integer Overflow or Wraparound in NVIDIA GeForce

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an incorrect comparison. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVE-2026-47556 High · 7.8 CWE-190 Sep 30, 2026

Integer Overflow or Wraparound in NVIDIA GeForce

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an integer overflow that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVE-2026-47510 High · 7.8 CWE-190 Sep 30, 2026

Integer Overflow or Wraparound in NVIDIA GeForce

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an integer overflow leading to an out-of-bounds write to GPU memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVE-2026-47502 High · 7.8 CWE-190 Sep 30, 2026

Integer Overflow or Wraparound in NVIDIA GeForce

NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer, where a guest user could cause an integer overflow leading to memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVE-2026-95616 High · 7.5 CWE-190 Sep 30, 2026

Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVE-2026-71973 Medium · 5.2 CWE-190 Sep 29, 2026

U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.

CVE-2026-95308 Low · 3.4 CWE-190 Sep 29, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-102633 Medium · 5.9 CWE-190 Sep 29, 2026

libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

CVE-2026-65102 High · 7.8 CWE-190 Sep 29, 2026

Integer Overflow or Wraparound in NVIDIA DeepStream

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, data tampering.

CVE-2026-63209 High · 7.5 CWE-190 Sep 29, 2026

Integer Overflow or Wraparound and Out-of-bounds Write in compress

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

CVE-2026-6103 Medium · 4.3 CWE-190 Sep 25, 2026

Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

CVE-2026-10758 High · 7.5 CWE-190 Sep 25, 2026

Esri Lerc has a security vulnerability

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service.