CWE-190: Integer Overflow vulnerabilities

CVE-2026-95107 is an integer overflow vulnerability in the Eclipse Foundation's Eclipse ThreadX module manager. The vulnerability occurs when the module manager adds a 16-byte private header to an object size without checking for overflow, causing the size to wrap around. This results in the allocation of a smaller memory block than required, leading to a buffer overflow where the header is written past the allocated block into adjacent memory.

The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count. That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.

. Security Fix(es): A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.(CVE-2026-101201)

CVE-2026-102834 is an integer overflow vulnerability in the IPCameraFrameGrabber component of bytedeco javacv prior to version 1.5.14. The flaw occurs when doubling a 32-bit buffer capacity without checking for overflow or bounding the Content-Length header in an MJPEG stream. A malicious or tampered MJPEG stream can trigger this condition, causing the frame-grabbing thread to enter a permanent CPU-spinning loop, resulting in a denial of service. The issue is fixed in version 1.5.14.

CVE-2026-102692 is a critical integer overflow vulnerability in the RIOT-OS microcontroller operating system affecting versions prior to 2026.07. It arises from the nanocoap module accepting oversized CoAP Block2 option values without enforcing the 20-bit maximum block number limit. This allows block offset multiplication to overflow on 32-bit targets, leading to invalid slice ranges. A remote CoAP client can exploit this by sending a malformed Block2 option, potentially causing out-of-bounds memory access, denial of service, or memory corruption. The vulnerability is fixed in version 2026.07.

CVE-2026-92160 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.3.0. The flaw occurs in the Svc::FileDownlink SendPartial function where a wrapping sum bypasses file-range validation, causing the process to abort or reset and resulting in denial of service. This issue is fixed in version 4.3.0.

CVE-2026-92154 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.2.0. The vulnerability occurs in the Svc::FileUplink component's handleDataPacket function, where offset and size validation uses wrapping 32-bit unsigned arithmetic. This allows an attacker to supply a byteOffset and dataSize whose sum wraps around, causing data to be written beyond the declared upload size. This can lead to file integrity loss and potentially large sparse-file growth or resource exhaustion. The issue is fixed in version 4.2.0.

CVE-2026-101972 is an integer overflow or wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated adjacent attacker can exploit this flaw by sending specific OSPFv2 packets on an OSPF-enabled interface to cause a denial of service. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS 3.1 base score is 6.5, indicating a medium severity impact focused on availability disruption.

CVE-2026-92158 is an integer overflow vulnerability in the NASA F´ (F Prime) framework used for spaceflight and embedded software. Versions prior to 4.2.0 perform a stack write validation that can overflow a 32-bit unsigned integer when adding an attacker-controlled offset and size, leading to out-of-bounds memory writes. This can cause memory corruption resulting in denial of service or potential code execution. The vulnerability is fixed in version 4.2.0.

CVE-2026-92157 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.3.0. The flaw occurs in the Svc::FileDownlink SendPartial range validation, where unchecked arithmetic on startOffset and length can cause a wraparound, leading to inconsistent offset values. This triggers an assertion failure under standard F Prime handling, causing the process to abort or reset and resulting in a denial of service. The issue is resolved in version 4.3.0.

CVE-2026-102036 is an integer overflow or wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured EVPN BGP peer to cause a denial of service by sending crafted EVPN Type-2 MAC/IP routes. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS v3.1 score is 7.5 (high severity), indicating a network attack vector with no privileges required and no user interaction, resulting in denial of service without confidentiality or integrity impact.

CVE-2026-102024 is an integer overflow or wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It affects versions where the extended-nexthop-tunnel feature is enabled. An authenticated BGP peer can exploit this flaw to cause a denial of service by sending crafted BGP route updates. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits are reported in the wild. The affected versions span multiple releases prior to specific patch levels across standard and evolved Junos OS versions.

CVE-2026-101945 is an integer overflow or wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It affects EVPN-enabled routing instances and allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service by disrupting control-plane adjacencies. The vulnerability has a high severity with a CVSS score of 7.5 and impacts multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases.

CVE-2026-101944 is an integer overflow or wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. This flaw allows an attacker to cause a denial of service by sending specially crafted EVPN route updates from an accepted EVPN BGP peer. The vulnerability has a high severity rating with a CVSS score of 7.5. It affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. No known exploits are reported in the wild, and no official patch links are provided in the input data.

CVE-2026-49206 is an integer overflow or wraparound vulnerability in the rapidcsv C++ CSV parser library versions prior to 8.99. The issue arises from converting size_t indexes to int before adding them to std::vector iterators on 64-bit systems. When handling CSV matrices with more than 2^31 elements, an index exceeding INT_MAX can wrap to a negative offset, causing undefined behavior, heap memory corruption, or a crash. Exploitation requires extremely large in-memory CSV documents, making typical use cases unlikely to be affected. The vulnerability is fixed in version 8.99.

CVE-2026-110449 is an integer overflow vulnerability in NixOS Nix affecting multiple versions prior to 2.35.3. The flaw occurs due to mishandling of list allocation when evaluating untrusted expressions, leading to an out-of-bounds write. This vulnerability can cause integrity impact and limited availability impact but does not affect confidentiality.

CVE-2026-100136 is an integer overflow or wraparound vulnerability in the Adobe Content Credentials Rust SDK that can cause an application denial-of-service. This flaw allows an attacker to crash the application without requiring user interaction, resulting in service disruption.

CVE-2026-88088 is an integer overflow or wraparound vulnerability in Microsoft SQL Server 2019 (GDR) that allows an authorized local attacker to elevate privileges. The issue affects multiple versions of SQL Server 2019 and later branches before specific fixed releases. Microsoft has released official patches to address this vulnerability.

Adobe Photoshop Desktop contains an integer overflow or wraparound vulnerability that can lead to arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction to be exploited and affects versions up to 27.10 and 26.11.7. The issue has a high severity rating with a CVSS score of 7.8.

Adobe Photoshop Desktop contains an Integer Overflow or Wraparound vulnerability (CWE-190) that may allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating high severity.