CWE-191: Integer Underflow vulnerabilities

CVE-2026-86537 is a high-severity vulnerability in Apache Thrift's D language bindings affecting versions before 0.25.0. It involves an uncaught exception, an infinite loop due to an unreachable exit condition, and an integer underflow (wraparound). The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-47585 is an integer underflow vulnerability in the NVIDIA GeForce GPU Display Driver for Windows kernel module. Exploitation could allow an attacker with limited privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific affected versions or patch information is provided in the available data.

CVE-2026-47540 is an integer underflow vulnerability in the kernel mode layer of NVIDIA GeForce GPU Display Drivers for Windows and Linux. Exploitation could allow an attacker with local privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The vulnerability has a high severity score of 7.8. No specific affected versions or patch information is provided.

CVE-2026-86133 is an integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked). A remote attacker who completes the initial IKEv2 handshake can send a specially crafted encrypted IKEv2 message to crash the iked process, causing a denial of service. The vulnerability affects multiple versions of Fireware OS and has been assigned a high severity score of 8.2. Fixed versions are available.

CVE-2026-86132 is an integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked). A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite, causing the iked process to crash. This vulnerability affects multiple versions of Fireware OS prior to their respective fixed releases. The vulnerability has a high severity score of 8.2 and does not require user interaction or privileges to exploit.

CVE-2026-102714 is a high-severity vulnerability in Eclipse ThreadX NetX Duo up to version 6.5.2.202603 when built with IPv6. It involves an out-of-bounds read caused by improper validation of ICMPv6 options, allowing a local host to send crafted messages that cause the IP thread to read beyond packet boundaries or loop indefinitely. This can lead to memory corruption in the neighbor cache.

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a partition can send a specially crafted request to the partition firmware runtime, causing it to crash with possible memory corruption.

CVE-2026-81881 is an out-of-bounds read vulnerability in radare2's Mach-O Swift field-metadata parser prior to version 6.2.0. The flaw occurs when a relative Swift field pointer is lower than the field-metadata section base, causing a negative logical index and reading memory before the allocated buffer. This can lead to incorrect metadata processing or process termination, but no memory disclosure has been demonstrated. The issue is fixed in radare2 version 6.2.0.

CVE-2026-93395 is an integer underflow vulnerability in the bson_new_from_buffer() function of the MongoDB C Driver. The function fails to validate that the BSON document length is at least 5 bytes, allowing a zero-length prefix to cause an integer wraparound. This leads to a heap out-of-bounds read and a process crash, resulting in a denial of service. The vulnerability affects versions from 2.0.0 up to but not including 2.3.1. No known exploits are reported in the wild. The CVSS 4.0 score is 6.9, indicating a medium severity.

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.

CVE-2026-91103 is an integer underflow vulnerability (CWE-191) in HP Linux Imaging and Printing Software (HPLIP) versions before 3.26.6. HP has identified and fixed multiple vulnerabilities in HPLIP that could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

CVE-2026-13326 is an out-of-bounds read vulnerability in Qt NFC's language code length parsing. This flaw allows a physically proximate attacker to cause a denial of service or limited memory disclosure by using a specially crafted NFC tag. The vulnerability affects Qt versions from 5.2.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.2. It has a CVSS 4.0 score of 6.9, indicating a critical severity level. No explicit patch links are provided in the data, and no known exploits are reported in the wild.

Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-66307 is an integer underflow vulnerability in Microsoft Skype for Business Server 2015 CU13 that allows an unauthorized attacker to cause a denial of service over the network. The flaw has been assigned a high severity with a CVSS score of 7.5. Official patches addressing this issue are available in versions 6.0.9319.885, 7.0.2046.569, and 7.0.2046.879.

CVE-2026-78453 is an integer underflow vulnerability in the Microsoft Windows SCSI Class System File affecting multiple versions of Windows 10 and some earlier Windows versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Microsoft has released official fixes for all affected versions.

CVE-2026-77488 is an integer underflow vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized local attacker to disclose information. The flaw involves a wrap or wraparound condition in integer handling. Microsoft has released official fixes for multiple affected versions. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-71352 is an integer underflow vulnerability in the Windows Remote Access Connection Manager component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official patches to address this issue.

CVE-2026-69824 is a critical integer underflow vulnerability in Microsoft Standard XPS on Windows 10 Version 1607 and other specified versions. This flaw allows an unauthorized attacker to execute code remotely over a network without user interaction or privileges. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released official fixes for all affected versions.

CVE-2026-69687 is an integer underflow vulnerability in the Windows USB Audio Class driver (usbaudio.sys) affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Official patches have been released to address this issue across all affected versions.