CVE-2026-16834 is a critical integer underflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to cause a denial of service condition. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and has a CVSS 3.1 base score of 9.8, indicating high severity with potential impacts on confidentiality, integrity, and availability.
CVE-2026-16933 is an integer overflow or wraparound vulnerability in IBM Power Systems Firmware affecting multiple firmware versions. It exists in the interface between the BMC/FSP and the host system. An attacker with service or root access to the BMC/FSP can exploit this flaw to read and write arbitrary host system memory, gaining full control over the host and all hosted partitions. This results in a critical impact on confidentiality, integrity, and availability.
CVE-2026-19321 is an integer overflow or wraparound vulnerability (CWE-190) in IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. An attacker with service access to the service processor can send a crafted command to leak contents of hardware registers that should be inaccessible. This could lead to limited confidentiality loss and availability impact on the affected host system. The vulnerability has a CVSS 3.1 score of 6.7, indicating a medium severity. No known exploits are reported in the wild, and no patch information is provided in the available data.
CVE-2026-55648 is an integer overflow vulnerability in FreeRDP prior to version 3.27.0. It occurs in the function freerdp_image_copy_from_icon_data, which calculates the required buffer size for icon data using 32-bit arithmetic. A malicious RDP server can send icon dimensions that cause this calculation to wrap around, bypassing bounds checks and potentially leading to out-of-bounds reads of attacker-controlled data. This affects RemoteApp clients using the vulnerable library path, while the xfreerdp client has a mitigation. The issue is fixed in FreeRDP version 3.27.0.
CVE-2026-55191 is a heap-based buffer overflow vulnerability in FreeRDP versions prior to 3.27.0. It occurs when a malicious RDP server negotiates RDPGFX AVC444 with an H.264 decoder backend, causing an integer overflow during buffer size calculation. This leads to allocation of an undersized buffer and subsequent heap corruption, potentially allowing code execution. The issue is fixed in FreeRDP version 3.27.0.
CVE-2026-52834 is a heap-based buffer overflow vulnerability in the tirr-c jxl-oxide JPEG XL decoder affecting versions prior to 0.12.6 and 0.6.2. On 32-bit platforms, crafted JPEG XL images can cause length calculation overflows leading to out-of-bounds writes during image decoding and rendering. This can result in memory corruption, denial of service, or arbitrary code execution. The issue is fixed in jxl-grid version 0.6.2 and jxl-oxide version 0.12.6.
A high-severity integer overflow vulnerability exists in libheif versions 1.19.0 through 1.22.999, affecting the parsing of HEIF sequences with the msf1 brand. The flaw allows crafted input to cause unbounded heap allocation due to improper bounds checking and 32-bit arithmetic wraparound, potentially leading to memory exhaustion and process crashes. This issue is fixed in version 1.23.0.
An integer overflow vulnerability exists in the websock_decode() function of the baresip re library prior to version 4.8.1. This occurs when validating a masked WebSocket frame with 64-bit extended length encoding, allowing a wraparound in the calculation 4 + hdr->len. This leads to a bounds check bypass and subsequent heap buffer overflow during XOR unmasking. Applications using websock_accept() or websock_accept_proto() to implement WebSocket servers are affected. Exploitation can cause heap corruption or denial of service after the HTTP WebSocket upgrade handshake. The issue is fixed in version 4.8.1.
CVE-2026-62357 is an integer overflow vulnerability in dragonflydb's dragonfly prior to version 1.40.0. The flaw occurs in CMS.INITBYDIM and CMS.INITBYPROB functions, where dimensions can overflow when calculating buffer size, leading to undersized allocation. This allows an unauthenticated remote attacker to corrupt or disclose adjacent heap memory and potentially crash the server. The issue is fixed in version 1.40.0.
CVE-2026-65346 is an integer overflow vulnerability in multiple Apple operating systems that could be triggered by processing a malicious image. This flaw may allow an attacker to execute arbitrary code. The issue has been addressed with improved input validation and fixed in specific versions of iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS, and watchOS. The vulnerability carries a high severity rating with a CVSS score of 8.8. No known exploits in the wild have been reported.
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.
CVE-2026-73193 is a critical integer overflow vulnerability in DBI for Perl versions before 1.652 on 32-bit Perl builds. It allows a heap out-of-bounds write due to an integer wraparound in the output buffer size calculation during statement preprocessing. This can lead to memory corruption when processing very large input statements. 64-bit Perl builds are not affected. The vulnerability has a CVSS score of 9.8, indicating high severity.
IBM i versions 7.3 through 7.6 contain an integer overflow vulnerability in the NetServer component. An authenticated attacker could exploit this flaw to cause a server thread exception, resulting in a temporary denial of service. The vulnerability arises during bounds checking in request processing. The CVSS score is 6.5, indicating a medium severity impact.
IBM i versions 7.3 through 7.6 contain an integer overflow vulnerability in the processing of DRDA large-object headers that could allow a remote attacker to cause a denial of service. The issue arises from an integer error leading to application disruption without impacting confidentiality or integrity.
CVE-2026-73645 is an integer overflow vulnerability in OpenZeppelin's openzeppelin-confidential-contracts library prior to version 0.3.1. The issue occurs in the ERC7984 contract where an internal _mint operation using an euint64 value can overflow silently. This leads to a scenario where users can transfer underlying tokens without receiving the corresponding confidential wrapped tokens, potentially causing loss of funds after approximately 18.4 trillion tokens are wrapped. The vulnerability is fixed in version 0.3.1.
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.
Rsync versions 3.1.0 through 3.4.4 contain a signed integer overflow vulnerability in the I/O timeout implementation. This flaw allows attackers to send crafted MSG_IO_TIMEOUT messages with zero or negative values, causing the timeout variable to wrap and disable connection timeouts. As a result, idle or stalled connections can occupy daemon slots indefinitely, leading to resource exhaustion.
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.
Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.