CWE-190: Integer Overflow vulnerabilities

Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.

An integer overflow or wraparound vulnerability exists in the AcademySoftwareFoundation openexr library in the readVariableLengthInteger() function. This function decodes variable-length integers from untrusted EXR input without properly bounding the shift count, leading to undefined behavior when a left shift by 70 bits on a 64-bit value occurs. The issue affects versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

CVE-2026-42144 is an integer overflow vulnerability in the CImg library used for image processing. The flaw occurs in the size calculation of image dimensions within the _load_pnm() function, where large dimension values cause an overflow that bypasses memory allocation checks. This results in an undersized buffer allocation and can lead to a heap buffer overflow when loading crafted PNM/PGM/PPM image files. The vulnerability affects all versions of CImg prior to commit 4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d. A patch addressing this issue has been committed. The CVSS score is 6.1, indicating a medium severity level. No known exploits are reported in the wild, and the product is not a cloud service.

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.

CVE-2026-33662 is an integer overflow vulnerability in the OP-TEE optee_os versions 3.8.0 through 4.10. It occurs in the emsa_pkcs1_v1_5_encode() function when calculating padding size for RSA keys with small modulus values, leading to an underflow. This causes a memset() call to overwrite memory beyond intended bounds, resulting in a crash of OP-TEE. The issue affects only platforms that register RSA acceleration. The vulnerability has a CVSS score of 7.5 and is classified as high severity due to its potential to cause denial of service by crashing the trusted execution environment. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

CVE-2026-32952 is a medium severity vulnerability in the Azure go-ntlmssp Go package prior to version 0.1.1. It involves an integer overflow or wraparound (CWE-190) that can cause a slice out of bounds panic when processing a malicious NTLM challenge message. This panic can crash any Go process using ntlmssp. Negotiator as an HTTP transport. The issue is patched in version 0.1.1. No known exploits are reported in the wild.

CVE-2026-33471 is a critical vulnerability in the nimiq-block Rust implementation prior to version 1.3.0. It involves improper input validation in the SkipBlockProof::verify function, where out-of-range signer indices can be exploited to bypass quorum checks. This allows a malicious validator with fewer than the required number of signer slots to pass verification by manipulating signature aggregation. The vulnerability has a CVSS score of 9.6, indicating high impact on integrity and availability. A patch fixing this issue was included in version 1.3.0.

Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes. Affected version is prior to commit 1.30.0.

Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagation. Affected version is prior to commit 1.30.0.

Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors. Affected version is prior to commit 1.30.0.

CVE-2026-41664 is an integer overflow vulnerability in Samsung Open Source ONE prior to version 1.30.0. The flaw occurs during memory copy size calculation when handling large tensor shapes, potentially causing invalid memory operations. The vulnerability has a CVSS 3.1 base score of 6.6, indicating medium severity. There is no official patch or remediation level currently confirmed by the vendor. Exploitation requires local access with limited privileges and user interaction. The impact includes limited confidentiality and integrity loss, with a high impact on availability.

Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption for oversized tensors. Affected version is prior to commit 1.30.0.

Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source ONE. Affected version is prior to commit 1.30.0.

Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE. Affected version is prior to commit  1.30.0.