CWE-191: Integer Underflow vulnerabilities

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.

An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

CVE-2026-24077 is an integer underflow vulnerability (CWE-191) in Qualcomm Snapdragon products that can lead to information disclosure when processing wireless network channel switch information with improperly formatted length fields. The vulnerability has a CVSS score of 6.5, indicating a medium severity. It affects a wide range of Qualcomm Snapdragon chipsets and related components. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

FreeRDP versions 3.28.0 and earlier have a heap buffer overflow vulnerability in the server-side RAIL channel handler due to an integer underflow when processing certain RAIL PDU headers. This flaw allows a malicious RDP client to cause an out-of-bounds heap write, potentially crashing the server. The issue is fixed in FreeRDP 3.29.0.

CVE-2026-63362 is an unsigned integer underflow vulnerability in the PubSub signature verification path of the open62541 library by o6 Automation. This flaw may allow a remote attacker to cause a denial of service by sending a crafted UDP packet. The vulnerability affects versions 1.3.0, 1.4.0, and 1.5.0 of open62541. The severity is rated medium with a CVSS score of 5.9. No official patch or remediation guidance is currently available.

CVE-2026-13308 is a high-severity integer underflow vulnerability in the Autel MaxiCharger AC Elite Home EV charger, specifically in the handling of WebSocket messages related to the OCPP service. This flaw allows remote attackers to execute arbitrary code without authentication by exploiting improper validation of user-supplied data, leading to an integer underflow before buffer allocation.

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)". The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

CVE-2026-66033 is a pre-authentication integer underflow vulnerability in libssh2 versions through 1.11.1. It occurs in the ssh2_cipher_crypt() function when negotiating AES-GCM ciphers during the SSH handshake. The flaw allows a malicious SSH server to cause an out-of-bounds read and a memcpy with a near-maximum length argument, leading to an immediate crash of the client process before authentication.

Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service  "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Absolute Security's Secure Access client software versions prior to 14.55. This flaw allows attackers who have detailed knowledge and full control over the tunnel protocol to cause a non-persistent denial of service (DoS) against the client. The vulnerability has a low severity rating and a CVSS score of 2.1. There is no official patch or remediation level currently stated by the vendor.

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Absolute Security's Secure Access client software versions prior to 14.55. This flaw allows attackers with detailed knowledge and full control over the tunnel protocol to cause a non-persistent denial of service (DoS) against the client. The vulnerability has a low severity rating and a CVSS score of 2.1. No known exploits are reported in the wild, and no official patch or remediation guidance has been provided yet.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.