CVE Database

CVE-2026-81666 Medium · 6.5 CWE-190 Sep 4, 2026

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.

CVE-2026-85438 Critical · 9.8 CWE-190 Sep 3, 2026

MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts

MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to write attacker-controlled doubles past the end of the IvPBox weight array, causing memory corruption and potential code execution.

CVE-2026-84965 Medium · 5.5 CWE-190 Sep 3, 2026

Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

CVE-2026-48486 High · 7.5 CWE-190 Sep 3, 2026

Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The vulnerability was introduced when the SMART_FEES hardfork (block ~1,029,000) enabled fee cash-back and burn accounting without overflow protection. This issue has been patched in version 3.9.9.

CVE-2026-9621 Critical · 9.2 CWE-190 Sep 1, 2026

RSLinx Classic® - Multiple Vulnerabilities

A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover

CVE-2026-84141 Critical · 9.8 CWE-190 Sep 1, 2026

Integer overflow in the Graphics: ImageLib component

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

CVE-2026-82737 Medium · 5.9 CWE-190 Sep 1, 2026

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as <<dim::unsigned-16, 0::unsigned-16>> followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535. This issue affects ash: from 2.14.13 before 3.32.2.

CVE-2026-55764 High · 8.7 CWE-190 Aug 28, 2026

Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evaluating whether Circulation exceeded MaxSupply, without checking for signed int64 overflow. A large positive raw Amount supplied through processSemiFungibleAddQuantity in core/kapp/kda/mint.go can wrap Circulation negative, causing the signed maximum-supply comparison to pass and crediting approximately MaxInt64 units while corrupting the on-chain counter. The fungible path is not affected because its MintedValue <= 0 guard detects the overflow. The correction uses the consensus activation flag FixMarketBuyOverflow. This issue is fixed in version 1.7.19.

CVE-2026-54755 Critical · 9.6 CWE-190 Aug 28, 2026

Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.

CVE-2026-38350 High · 7.5 CWE-190 Aug 27, 2026

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg…

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

CVE-2026-38349 High · 7.5 CWE-190 Aug 27, 2026

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg…

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

CVE-2026-38348 High · 7.5 CWE-190 Aug 27, 2026

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1…

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

CVE-2026-38346 High · 7.5 CWE-190 Aug 27, 2026

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg…

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

CVE-2026-38343 Medium · 6.5 CWE-190 Aug 27, 2026

An integer overflow in the libavfilter/vf_scale.c component of FFmpeg…

An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

CVE-2026-37198 High · 7.5 CWE-190 Aug 27, 2026

An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a…

An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.

CVE-2026-30045 High · 7.5 CWE-190 Aug 27, 2026

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows…

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted HTTP/2 GET request.

CVE-2026-47857 Medium · 5.9 CWE-190 Aug 26, 2026

Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier

CVE-2025-70290 Critical · 9.8 CWE-190 Aug 26, 2026

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability…

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.

CVE-2026-79902 Medium · 5.5 CWE-190 Aug 26, 2026

Gimp: stack vla size underflow denial of service in seattle

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.

CVE-2026-76149 Medium · 4.4 CWE-190 Aug 26, 2026

Integer Overflow or Wraparound in SASAKI Nobuyuki CorvusSKK

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.

CVE-2026-79292 High · 8.3 CWE-190 Aug 25, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79223 High · 8.8 CWE-190 Aug 25, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Chromium security severity: Low)

CVE-2026-79215 High · 8.8 CWE-190 Aug 25, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-78950 High · 8.8 CWE-190 Aug 25, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-52491 High · 8.4 CWE-190 Aug 25, 2026

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to…

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component