CWE-190: Integer Overflow vulnerabilities

CVE-2026-69957 is an integer overflow or wraparound vulnerability in the Windows Overlay Filter component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for multiple affected versions.

CVE-2026-105715 is an integer overflow or wraparound vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 7.5 and affects multiple versions prior to specific fixed releases. Official patches have been released by Microsoft to address this issue.

CVE-2026-102856 is a heap-based buffer overflow vulnerability in Microsoft Office Visio within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects certain versions prior to 16.0.14334.20974 and 16.0.17932.21056. Microsoft has released official fixes for this issue. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-108400 is an integer overflow or wraparound vulnerability in the Microsoft HEVC Video Extensions codec library. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of the HEVC Video Extensions prior to fixed releases. Microsoft has issued an official fix to address this issue.

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.

CVE-2026-77093 is an integer overflow vulnerability (CWE-190) in Commvault Commvault Cloud components that can affect service availability. The issue impacts multiple Commvault software components including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale. The vulnerability has a high severity with a CVSS 4.0 base score of 7.1. Users are advised to upgrade to the resolved maintenance releases to mitigate the issue.

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

CVE-2026-109938 is an integer overflow or wraparound vulnerability in FreeRDP version 3.11.0. This flaw occurs due to positive mapped-video coordinates overflowing, which can cause the FreeRDP client to abort. A malicious or compromised RDP server can exploit this vulnerability to terminate the client session when video redirection is enabled.

CVE-2026-97229 is a critical integer overflow vulnerability in GitLab CE/EE versions 19.2 prior to 19.2.8, 19.3 prior to 19.3.5, and 19.4 prior to 19.4.2. It allows an unauthenticated attacker to execute arbitrary code on the GitLab server by exploiting insufficient validation of specially crafted regular expressions in CI/CD configurations. The vulnerability has been publicly disclosed and is actively exploited in the wild with available Metasploit modules. Fixed versions have been released to address this issue.

CVE-2026-109448 is an integer overflow vulnerability in the PostgreSQL psqlODBC driver affecting versions from 08.01.0102 up to but not including 18.00.0005. The flaw arises from a signed 16-bit field used to store the binding count in SQLBindParameter, which can wrap around when binding parameter number 32768 or higher. This causes heap memory corruption, potentially crashing the application or leaving it in a corrupted state. Applications that construct parameter lists from untrusted input are particularly at risk.

CVE-2026-103635 is an out-of-bounds read vulnerability in the Apache DataSketches C++ library affecting the compact Theta sketch deserialization process. The vulnerability arises because header fields are read before verifying the input length, allowing crafted or truncated sketches to cause reads past the input end. This can lead to crashes (denial of service) and potential exposure of adjacent memory. The issue affects versions from 3.1.0 up to and including 5.2.0. Upgrading to version 5.3.0 resolves the vulnerability.

CVE-2026-107820 is an integer overflow vulnerability in the duty1g x64dbg-MCP Server plugin prior to version 1.2. The vulnerability arises from parsing an unbounded Content-Length header and performing unchecked addition, which can cause a runtime integer-overflow panic. This leads to termination of the x64dbg process and its live debugging session, resulting in a denial of service. The server listens on all interfaces by default, allowing unauthenticated network clients to trigger this condition. The issue is fixed in version 1.2.

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.

CVE-2026-107324 is an integer overflow vulnerability in the BSON value-length handling of the MongoDB Go Driver. This flaw can cause a runtime panic when processing malformed BSON documents, potentially leading to denial of service. An unauthenticated attacker able to supply crafted BSON bytes may cause the application to terminate. The vulnerability affects specific versions of the MongoDB Go Driver. Panic recovery in the server-monitoring path limits impact to server-selection failures in that context.

containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.

CVE-2026-107224 is an integer overflow vulnerability in the qax-os excelize library affecting versions from 2.1.0 through 2.11.0. It arises from improper handling of Zip64 uncompressed sizes that, when set to values with the high bit set, cast to negative int64 values. This bypasses unzip size guards and leads to a panic due to a negative capacity passed to Go's make function, causing a runtime error and crashing the calling goroutine. The vulnerability can be triggered by a crafted 159-byte archive without authentication.

CVE-2026-107217 is an integer overflow vulnerability in the Excelize Go library used for reading and writing Microsoft Excel spreadsheets. The function ColumnNameToNumber does not detect overflow when converting long column names to numeric indices, causing a wraparound to zero. This leads to a negative slice index during worksheet normalization, which can cause the application to panic and terminate unexpectedly. No fixed version is currently available.

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function that causes heap corruption when loading a personal wordlist with words whose length is a multiple of 256. This can lead to denial of service if a user runs aspell with a crafted personal wordlist. The issue is fixed in version 0.60.8.3.

CVE-2026-20533 is an integer overflow vulnerability in MediaTek chipsets that can lead to local escalation of privilege. Exploitation does not require user interaction but requires the attacker to already have System privilege. The vulnerability affects multiple MediaTek chipset versions and has a medium severity rating with a CVSS score of 6.7.