| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution. |
| llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers. |
| flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process. |
| libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes. |
| compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2. |
| The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems. |
| An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to unexpected app termination. |
| llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts. |
| An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory. |
| An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Connecting to a malicious VNC server may cause a denial-of-service. |
| An integer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected system termination. |
| An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption. |
| An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption. |
| Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network. |
| rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99. |
| HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools. |
| FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap. |
| A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate. |
| In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
entry->value is u32 and entry->length is u16; the sum is performed in
u32 and wraps. A malicious XDomain peer can pick
value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0
and passes the > block_len check. tb_property_parse() then passes
entry->value to parse_dwdata() as a dword offset into the property
block, reading attacker-directed memory far past the allocation.
For TEXT-typed entries with the "deviceid" or "vendorid" keys this
lands in xd->device_name / xd->vendor_name and is readable back via
the per-XDomain device_name / vendor_name sysfs attributes; the leak
is NUL-bounded (kstrdup() stops at the first zero byte) and
untargeted (the attacker picks a delta, not an absolute address).
DATA-typed entries are parsed into property->value.data but not
generically surfaced to userspace.
Use check_add_overflow() so a wrapped sum is rejected. |
| Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally. |
