CWE-190: Integer Overflow vulnerabilities

OpenAPV versions before 1.1.1.0 contain a heap-based buffer overflow vulnerability caused by an integer overflow or wraparound (CWE-190). This vulnerability can lead to memory corruption when reading bitstreams. The issue has a medium severity with a CVSS 4.0 base score of 5.1. No official patch or remediation details are provided in the available data.

CVE-2026-66837 is a high-severity stack-based buffer overflow and integer overflow vulnerability in the PHP bindings of Apache Thrift. It affects all versions prior to 0.25.0. The issue allows for potential memory corruption due to improper handling of buffer sizes. Apache has released version 0.25.0 to address this vulnerability.

CVE-2026-83632 is a critical vulnerability in Apache Thrift before version 0.25.0 involving allocation of resources without limits or throttling, integer overflow or wraparound, and a heap-based buffer overflow. This flaw can lead to severe impacts including potential denial of service or arbitrary code execution. The issue is fixed in Apache Thrift version 0.25.0. Users should upgrade to this version to mitigate the risk.

CVE-2026-93546 is an integer overflow vulnerability in the mod_dav_fs module of Apache HTTP Server up to version 2.4.68. An authenticated WebDAV client with write access can exploit this flaw by sending PROPPATCH requests with many XML namespaces, causing worker process crashes and persistent corruption of a directory's property database.

CVE-2026-102504 affects Imager for Perl versions before 1.037. The vulnerability arises from improper handling of the raw_datachannels value in the i_readraw_wiol function, which lacks range checking. This can cause the program to request an excessive memory allocation, leading to process termination via an uncatchable exit call when allocation fails.

A vulnerability identified as CVE-2026-47577 exists in the NVIDIA GPU Display Driver for Windows kernel module. It involves an integer overflow or wraparound issue that can cause incorrect comparisons. Exploitation of this flaw could allow an attacker to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific affected versions or patch information is provided.

CVE-2026-47556 is an integer overflow vulnerability in the NVIDIA GeForce GPU Display Driver kernel mode layer for Windows and Linux. An unprivileged user could exploit this flaw to cause an out-of-bounds write. Successful exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific affected versions or patch information is provided.

CVE-2026-47510 is an integer overflow vulnerability in the kernel mode layer of NVIDIA GeForce GPU Display Drivers for Windows and Linux. This flaw allows a local user with limited privileges to trigger an integer overflow, resulting in an out-of-bounds write to GPU memory. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a high severity with a CVSS score of 7.8. No specific affected versions or patch information is provided.

CVE-2026-47502 is an integer overflow vulnerability in the NVIDIA vGPU Virtual GPU Manager kernel mode layer for Windows and Linux. A guest user could exploit this flaw to cause memory corruption. Successful exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific affected versions or patches are provided in the available data.

Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application, causing a denial of service. The individual defects are: - Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1). - Transport read helpers allocate buffers of the size claimed on the wire without an upper bound. - ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic. - ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing. - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 . Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as additional, independent protocol messages. This issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases. Users are recommended to upgrade to version 1.0.0, which fixes the issue.

CVE-2026-102804 is an integer overflow vulnerability in the hexwave_init function of the stb_hexwave.h library within Nothings stb. The flaw occurs due to improper handling of the width or oversample arguments, which can lead to integer overflow. Remote exploitation is possible, and public exploit code is available. The vulnerability has a medium severity with a CVSS score of 6.5. The project has been notified but has not yet issued a patch or response.

CVE-2026-102620 is an integer overflow vulnerability in Freedesktop Poppler versions 26.06.0, 26.07.0, and 26.08.0. It affects the function FoFiTrueType::cvtSfnts in the source file fofi/FoFiTrueType.cc. The vulnerability can be exploited only locally and has a medium severity score of 4.8. A patch identified by commit 245d3c6823377755f2c1d5fdddd010279c6ed94d is available to address this issue.

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

NVIDIA DeepStream versions up to 0-9.0.1 contain an integer overflow vulnerability triggered by crafted tensor dimensions in a YAML configuration file. Exploitation could lead to denial of service, information disclosure, or data tampering. The vulnerability has a high severity with a CVSS score of 7.8. No vendor patch or advisory is currently provided. No known exploits are reported in the wild.

A security vulnerability exists in Trusted Domain Project OpenDMARC up to version 1.4.2. The flaw is an integer overflow caused by manipulation of the 'pct' argument in the DMARC Parser component, specifically in the file libopendmarc/opendmarc_policy.c. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor has not responded to the disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-10758 is a high-severity vulnerability in Esri LERC, an open-source image/raster format library. It involves an integer overflow or wraparound leading to a heap-based out-of-bounds write. This flaw affects LERC versions 0 through 4.1.0 and earlier. A remote, unauthenticated attacker can exploit this by supplying crafted imagery to cause an application crash, resulting in denial of service. No confidentiality or integrity impact is reported. No patch information is currently available.

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.