CVE-2026-75538 is an integer overflow vulnerability in Erlang OTP's inet driver when using {packet,4} mode on an open TCP port. An attacker can trigger a signed overflow in packet length calculation, causing a buffer overflow that corrupts the BEAM VM allocator metadata and likely crashes the VM. Exploitation for remote code execution is considered extremely unlikely. This affects multiple OTP and erts versions prior to specific fixed releases.
A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover
Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.
Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as <<dim::unsigned-16, 0::unsigned-16>> followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.
This issue affects ash: from 2.14.13 before 3.32.2.
CVE-2026-55764 is an integer overflow vulnerability in klever-io's klever-go blockchain protocol implementation. Before version 1.7.19, a mint-role holder could bypass the finite per-nonce MaxSupply limit on semi-fungible token quantity additions. The flaw occurs because the code increments the circulation count before checking for overflow, allowing a large positive amount to wrap the circulation value negative and bypass the maximum supply check. This leads to crediting approximately MaxInt64 units and corrupting the on-chain counter. The issue is fixed in version 1.7.19.
CVE-2026-54755 is a critical integer overflow vulnerability in klever-go, the Go implementation of the Klever blockchain protocol. Prior to version 1.7.19, crafted split-royalty values can cause uint32 accumulator wraparound, bypassing validation checks. This allows creation of unbacked KLV or other assets during asset transfers, marketplace purchases, or ITO purchases. The issue is fixed in version 1.7.19.
An integer overflow vulnerability exists in the target_sws_fuzzer() function within libswscale/output.c of FFmpeg N-122528-gdd2976b9e1. This flaw allows an attacker to cause a Denial of Service (DoS) by supplying crafted input. The vulnerability is identified as CVE-2026-38350 and has a high severity rating with a CVSS score of 7.5. No patch or remediation information is currently provided.
An integer overflow vulnerability exists in the hScale16To19_c() function within libswscale/output.c of FFmpeg N-122528-gdd2976b9e1. This flaw allows an attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. The vulnerability has a high severity rating with a CVSS score of 7.5. No patch or remediation information is currently provided. There are no known exploits in the wild at this time.
An integer overflow vulnerability exists in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1. This flaw can be triggered by supplying a crafted image file, leading to a denial of service (DoS) condition. The vulnerability does not affect confidentiality or integrity but impacts availability. No specific affected versions are stated, and no patch information is provided.
An integer overflow vulnerability exists in the yuv2planeX_8_c() function within libswscale/output.c of FFmpeg N-122528-gdd2976b9e1. This flaw can be triggered by processing a crafted video file, leading to a Denial of Service (DoS) condition.
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
An integer overflow vulnerability exists in the SMF component of Open5GS version 2.7.6. This flaw can be triggered by an attacker supplying a crafted GTP packet, resulting in a Denial of Service (DoS) condition. The vulnerability does not impact confidentiality or integrity but causes service disruption.
CVE-2026-47857 is an integer overflow vulnerability in Spring Reactor Core affecting applications using the Flux.windowTimeout operator with fairBackpressure enabled. This flaw can lead to a Denial of Service (DoS) condition. The vulnerability impacts multiple versions of Reactor Core, including 3.8.0 through 3.8.6, 3.5.0 through 3.7.19, and 3.4.41 and earlier. The CVSS score is 5.9, indicating a medium severity level. No official patch or remediation guidance is currently available.
An integer overflow vulnerability exists in AcademySoftwareFoundation's OpenEXR library versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. The overflow occurs during decoding of crafted deep tiled EXR files, leading to a crash due to an invalid memory read. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
CVE-2026-59982 is an integer overflow or wraparound vulnerability in the AcademySoftwareFoundation's OpenEXR library. Affected versions include >=3.1.0 <3.2.11, >=3.3.0 <3.3.13, and >=3.4.0 <3.4.14. The flaw allows the TypedDeepImageChannel::row() function to return an out-of-bounds pointer when processing a crafted deep EXR file with a nonzero dataWindow origin. This can lead to a crash or limited information disclosure. The issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14. The CVSS score is 7.1, indicating a high severity vulnerability.
A heap-based buffer overflow vulnerability exists in AcademySoftwareFoundation's openexr library in certain versions when processing crafted tiled EXR files on 32-bit/ILP32 builds. The issue arises due to an integer overflow in buffer size calculation, leading to out-of-bounds writes during tile decoding. This vulnerability is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
An integer overflow vulnerability in NI LabVIEW allows an out-of-bounds write, potentially leading to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. This affects NI LabVIEW 2026 Q3 and earlier versions. The vulnerability has a medium severity score of 6.6 CVSS and no confirmed patch or official remediation yet.
OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an integer overflow vulnerability in the SampleCountChannel component. This flaw causes an infinite loop when the sample-list size is rounded up to the next power of two, due to a 32-bit unsigned integer wraparound. The issue can be triggered via public APIs by setting a pixel sample count to UINT_MAX. This vulnerability has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.
A vulnerability in OpenEXR versions 3.4.0 through 3.4.12 allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort when exr_start_read() is called on untrusted input. This is due to an assertion failure triggered by invalid QCD marker bits passed to the OpenJPH library, resulting in a denial of service. The issue is fixed in version 3.4.13.
CVE-2026-78465 is an integer overflow vulnerability in the file-pcx plugin of GIMP affecting only 32-bit builds. The flaw occurs when processing crafted PCX image files with 4 color planes and large dimensions, causing an integer overflow in memory allocation size calculation. This results in an undersized heap buffer and subsequent heap-based buffer overflow when image data is written, leading to memory corruption. Exploitation requires user interaction to open a malicious PCX file and could lead to arbitrary code execution or denial of service. Default security features like SELinux, ASLR, and NX reduce the likelihood of successful exploitation.
An out-of-bounds read vulnerability exists in iccDEV versions prior to 2.3.2.1 due to a size_t underflow in the CIccEmbedIO::Read8() function. This occurs when parsing ICC profiles containing specific embedded profile tags. The issue is patched in version 2.3.2.1. No known workarounds are available.