CVE-2026-83855 is an integer underflow vulnerability in the Windows WLAN Service of Microsoft Windows 11 version 23H2. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has released official fixes for affected versions.
CVE-2026-83838 is an integer underflow vulnerability in the Windows Bluetooth A2DP driver affecting multiple Windows 10 versions. It allows an authorized attacker to elevate privileges over an adjacent network. The vulnerability has a high severity score and has been officially fixed in specific Windows 10 updates.
CVE-2026-83836 is a heap-based buffer overflow vulnerability in the Windows Event Tracing component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized local attacker to execute code on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.
CVE-2026-83578 is a critical integer underflow vulnerability in Windows PowerShell on Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-70064 is an integer underflow vulnerability in the Windows Kerberos component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.8 and affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for all affected versions.
CVE-2026-65200 is an integer underflow vulnerability in Huawei openBMC's device-management process. The flaw occurs in the parsing of PLDM-over-MCTP and NCSI-over-MCTP responses, where the code subtracts a fixed header size from a device-supplied response length without checking for lower bounds. This can cause the length to wrap around to a large value, leading to out-of-bounds reads. The vulnerability affects the base PLDM control class and Huawei NCSI driver, making it reachable by any PLDM endpoint or Huawei NIC on the internal management bus. The CVSS score is 3.5, indicating low severity. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-102073 is a high-severity integer underflow vulnerability affecting multiple Siemens APOGEE and TALON products. The vulnerability arises from improper validation of user-controllable input length in the affected product web service. Exploitation could allow an unauthenticated remote attacker to read portions of device memory or cause a denial-of-service condition. The issue impacts all versions of APOGEE MBC (PPC) (BACnet and P2 Ethernet), APOGEE MEC (PPC) (BACnet and P2 Ethernet), and TALON TC Modular (BACnet). It also affects APOGEE PXC Compact and Modular (BACnet and P2 Ethernet) versions prior to 3.5.7 and 2.8.21 respectively.
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability.
CVE-2026-53922 is a stack-based buffer overflow vulnerability in the odhcpd DHCP server component of OpenWrt. It allows an unauthenticated attacker on the same network link to send crafted DHCPv6 RENEW messages with multiple IA_NA options, triggering a buffer overflow in the server's stack buffer. This overflow leads to process termination via stack canary detection, causing denial of service by repeatedly disrupting DHCPv6 service. No code execution has been observed from this vulnerability.
CVE-2026-109246 is a high-severity integer underflow vulnerability in FreeRDP versions before 3.32.0 affecting the freerdp-shadow-cli shadow server. An authenticated client can send a Frame Acknowledge PDU with a frame id one greater than the last frame sent, causing an underflow in the in-flight frame count. This leads to a divide-by-zero error that terminates the process and disconnects all viewers.
CVE-2026-107794 is an integer underflow vulnerability in ExtUtils::Typemaps::STL::List for Perl versions before 1.07. The flaw causes the module to allocate a very large 32 GiB array when processing an empty list due to an underflow in the av_extend function call. This results in memory exhaustion. A similar issue was previously fixed in the related ExtUtils::Typemaps::STL::Vector module.
An out-of-bounds read vulnerability exists in the VarOpt union deserialization function of Apache DataSketches C++ versions from 2.0.0-incubating up to 5.2.0. The flaw occurs because the deserialization reads more bytes than available in a truncated serialized union, potentially reading up to 24 bytes past the input end. This can cause a crash (denial of service) and may expose adjacent memory contents. Only applications deserializing VarOpt unions from untrusted sources are affected. The issue is fixed in version 5.3.0.
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.
CVE-2026-106429 is an integer underflow vulnerability in MongoDB's libmongocrypt library affecting versions from 1.1.0 up to but not including 1.20.5. The flaw occurs in the KMS endpoint-parsing logic and can cause an allocation failure that terminates the application process. Exploitation requires an authenticated user to modify a key document in the key vault collection or for an application to accept a specially crafted KMS endpoint containing a colon after its path or query during key creation. This vulnerability does not lead to memory corruption or out-of-bounds access.
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSH_RealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the size_t computation n - strlen(s1) - 1 wraps to near SIZE_MAX. The strncat() call is then effectively unbounded and copies the whole component; when that component exactly fills the remainder of the buffer, its terminating null is written one byte past the end. The caller's own length check keeps the copied data inside the buffer, so the overflow is limited to that single null byte, which may corrupt an adjacent stack value and crash the process. Applications that call the public wolfSSH_RealPath() with an output buffer smaller than the input path are additionally exposed to an unbounded copy, because the word32 expression outSz - segSz in that length check also wraps.
CVE-2026-102168 is an integer underflow vulnerability affecting Arista Networks Wi-Fi Access Points with Captive Portal enabled. An unauthenticated wireless client connected to such an SSID can send a crafted HTTP request that crashes the portal service, causing a temporary denial of service until the service restarts automatically. Remote code execution is not possible. The vulnerability affects multiple versions of the product as specified. The CVSS score is 6.5, indicating a medium severity impact focused on availability.
CVE-2026-84411 is a critical integer underflow vulnerability in the web management service of MikroTik RouterOS versions prior to 7.24. This flaw is exploitable without authentication via a crafted HTTP request body, allowing an attacker to execute arbitrary code as root or cause a denial of service. The vulnerability is fixed in RouterOS version 7.24.