CWE-191: Integer Underflow vulnerabilities

CVE-2026-69421 is an integer underflow vulnerability in the Windows Kernel Mode Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-69303 is an out-of-bounds read vulnerability in the Push Message Routing Service of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. A patch is available from Microsoft to address this issue.

CVE-2026-69269 is an integer underflow vulnerability in Microsoft Standard XPS on Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-68827 is an integer underflow vulnerability in the Windows GDI+ component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability has a high severity rating with a CVSS score of 8.0. Official fixes have been released for all affected versions.

CVE-2026-72947 is an integer underflow vulnerability in the Windows File History Service on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker with high privileges to elevate their privileges further. The vulnerability has been assigned a CVSS score of 6.4 (medium severity). Official patches have been released to address this issue in multiple Windows 10 builds.

CVE-2026-69859 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows USB Audio Class driver (usbaudio.sys) affecting multiple versions of Microsoft Windows 10, including version 1607 and later builds. This flaw allows a locally authorized attacker to elevate privileges. The vulnerability has been assigned a high severity score and has been officially fixed in specific Windows 10 builds.

CVE-2026-69276 is a critical integer underflow vulnerability in the Microsoft UxTheme Library (uxtheme.dll) affecting multiple versions of Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Microsoft has released official fixes for all affected versions.

CVE-2026-66767 is an integer underflow vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform. It allows an unauthenticated attacker to send a specially crafted packet that causes reprocessing of a previously buffered user request. This can potentially lead to session hijacking under narrow timing conditions. The vulnerability impacts confidentiality and integrity with high severity and has a low impact on availability.

CVE-2026-18355 is a heap buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base) used in Red Hat Directory Server 11.5 E4S for RHEL 8. The flaw arises from an integer underflow when processing a small wrapped-record length during SASL communication, leading to a large read request into a small heap buffer. An authenticated attacker who successfully completes a SASL bind with integrity protection can exploit this to cause denial of service or potentially remote code execution. This issue is distinct from CVE-2026-11774, which only addressed upper-bound length validation.

A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a  restart of the service to recover.

A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover.

CVE-2026-54754 is a critical integer underflow vulnerability in klever-io's klever-go blockchain protocol implementation prior to version 1.7.19. It involves marketplace settlement logic where combined referral and royalty percentages can exceed the bid amount, causing the system to credit more tokens than the buyer paid. This leads to creation of unbacked currency and corruption of token supply integrity. The issue is fixed in version 1.7.19.

CVE-2026-71401 is an integer underflow vulnerability in the DHCPv4 packet capture code of SUSE wicked. The function ni_capture_inspect_udp_header() does not properly verify that the IP total length is at least as large as the IP header length before performing a subtraction, leading to an out-of-bounds read. An unauthenticated attacker on the same network can exploit this to crash the wicked DHCPv4 client daemon. No information disclosure or other impacts have been demonstrated. This affects wicked versions up to and including 0.6.80.

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

CVE-2026-18916 is an integer underflow vulnerability in NLnet Labs NSD version 3.2.11. A remote attacker can cause a denial of service by crashing NSD server child processes through throttling the TCP receive window after a TCP query. This continuous crashing results in denial of all TCP services from the affected NSD instance.

An integer underflow vulnerability (CWE-191) exists in Adobe's C2PA Tool, which can be exploited to cause an application denial-of-service (DoS) by crashing the application. Exploitation does not require user interaction and can be performed with low privileges and low attack complexity.

An integer underflow vulnerability (CWE-191) exists in Adobe C2PA Tool's CAI Content Credentials component. This flaw can be exploited remotely without user interaction to cause the application to crash, resulting in a denial-of-service condition. The vulnerability has a high severity rating with a CVSS score of 7.5. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.