CVE-2026-100208 is an integer overflow or wraparound vulnerability in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects versions 16.0.0 and 16.0.1 of the software. An official fix is available from Microsoft, and the vendor manages remediation for this cloud-hosted service. There are no known exploits in the wild at this time.
CVE-2026-96749 is an integer overflow vulnerability in the BSON document encoding component of the MongoDB Python Driver's native extension. It occurs when a single document is constructed from a very large amount of user-supplied data, causing size arithmetic to overflow a signed 32-bit integer. This can lead to a write outside the bounds of an allocated buffer within the application's process. The vulnerability affects versions from 1.9.0 up to but not including 4.18.2. No exploits are known in the wild, and the vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-93577 is a critical integer overflow vulnerability in GitLab CE/EE versions 19.2 prior to 19.2.7, 19.3 prior to 19.3.3, and 19.4 prior to 19.4.1. It allows an authenticated user to execute arbitrary code on the GitLab server by exploiting an integer overflow when compiling a specially crafted regular expression in a CI/CD configuration.
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-18462 is a high-severity vulnerability in RTI Connext Professional Core Libraries involving integer overflow or wraparound and improper access control. It allows shared resource manipulation in affected versions. The flaw impacts versions 6.1.0, 7.0.0 up to but not including 7.3.1.6, and 7.4.0 up to but not including 7.7.0.1. The vulnerability has a CVSS 4.0 base score of 7.3, indicating significant risk but requiring local access with high attack complexity and privileges. No known exploits are reported in the wild. No vendor patch or remediation details are provided in the input data.
An integer overflow vulnerability exists in radare2's CPython bytecode .pyc marshal parser prior to version 6.2.0. The vulnerability occurs because the parser accepts a 32-bit string length that can overflow the allocation size, leading to heap memory corruption when processing crafted .pyc files. This can cause denial of service, and while arbitrary code execution is possible, it has not been demonstrated. The issue is fixed in radare2 version 6.2.0.
Net::IDN::Punycode versions before 2.590 for Perl contain an integer overflow vulnerability in the XS backend's encode_punycode function. This overflow occurs due to lack of checks on the delta accumulator during encoding, allowing out-of-bounds reads from the digit table. An attacker can supply crafted input that causes the process to crash or copy unintended bytes into the encoded output. The vulnerability has a medium severity with a CVSS score of 6.5.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.
CVE-2026-91142 is an integer overflow vulnerability in the do_lastlog() function of Cockpit on ILP32 builds in Red Hat Enterprise Linux 10. A low-privileged authenticated user with a large UID can cause offset calculation wraparound, leading to unauthorized reads and writes of other users' lastlog records. This may disclose or alter sensitive login accounting information but does not allow code execution or privilege escalation. The vulnerability has a low severity with a CVSS score of 3.6.
virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the gif palette, resulting in a process crash and denial of service. The affected implementation is identified by src/gif.imageio/gif.h, GifSplitPalette(), numPixels, subPixelsA, GIFOutput, and truncated TGA input, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
CVE-2026-25290 is a high-severity integer overflow vulnerability in Qualcomm Snapdragon products WSA8840 and WSA8845. It involves memory corruption caused by improper validation of large data buffers using addition to check buffer length. This flaw can lead to high impact on confidentiality, integrity, and availability.
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04.
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.
CVE-2026-92259 is an integer overflow or wraparound vulnerability in Samsung Opensource Escargot. It allows attackers with write access to the bytecode-cache directory to trigger a heap-based buffer overflow, leading to denial of service. The vulnerability affects a specific Escargot commit identified by ac94df78493ee6fede286620d94f724e46b4d238. No patch or remediation information is provided.