CWE-190: Integer Overflow vulnerabilities

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.

CVE-2026-89158 is an integer overflow vulnerability in PCRE2 versions before 10.48 on 32-bit platforms. The flaw exists in the pcre2_compile_32 function, leading to an integer overflow and a subsequent out-of-bounds write. This vulnerability can cause integrity issues and limited availability impact but does not affect confidentiality.

CVE-2026-89157 is an integer overflow or wraparound vulnerability in PCRE2 versions 10.30 up to but not including 10.48 on 32-bit platforms. It occurs in the pcre2_pattern_convert function when processing a large pattern, leading to an out-of-bounds write. This vulnerability has a medium severity with a CVSS score of 5.7 and impacts the integrity and availability of affected systems.

CVE-2026-16174 is an integer overflow vulnerability in Netskope Endpoint DLP running on Windows. It requires the Endpoint DLP module enabled and Memory Integrity disabled. Exploitation could lead to memory corruption, potentially causing denial-of-service, arbitrary code execution, or privilege escalation locally. The vulnerability affects versions prior to 141.0. The CVSS 4.0 score is 8.7, indicating high severity.

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

CVE-2026-85228 is a critical integer overflow vulnerability in the tensor buffer validation component of Amazon Deep Java Library (DJL) versions 0.13.0 through 0.36.0. This flaw could allow a remote unauthenticated attacker to read adjacent process memory or cause a denial of service by sending a specially crafted tensor payload. The issue is fixed in version 0.37.0 and later.

Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Photoshop 2026 contains an integer overflow or wraparound vulnerability that may allow arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction to be exploited and affects versions up to 27.6 and 26.11.6. The flaw could lead to full compromise of the affected system under the context of the current user.

Adobe Photoshop 2026 contains an integer overflow or wraparound vulnerability that could allow arbitrary code execution when a user opens a specially crafted malicious file. Exploitation requires user interaction. The vulnerability affects versions up to and including 27.6 and 26.11.6. The issue has a high severity rating with a CVSS score of 7.8.

Adobe Photoshop 2026 contains an integer overflow or wraparound vulnerability that may allow arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction and affects certain versions of Photoshop 2026. The issue has a high severity rating with a CVSS score of 7.8.

Adobe Photoshop 2026 contains an Integer Overflow or Wraparound vulnerability (CWE-190) that may allow arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction and affects certain versions of Photoshop 2026. The issue has a high severity rating with a CVSS score of 7.8.

CVE-2026-84000 is a heap-based buffer overflow vulnerability in the Microsoft Graphics Component affecting multiple versions of Microsoft Windows 10, including Version 1607 and later builds. An authorized local attacker can exploit this flaw to execute arbitrary code with elevated privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Official patches have been released by Microsoft to address this issue.

CVE-2026-81949 is an integer overflow or wraparound vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code locally on the affected system. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A high-severity CVSS 3.1 score of 7.8 has been assigned. Official patches have been released by Microsoft to address this issue.

CVE-2026-81959 is a heap-based buffer overflow vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code locally on the affected system. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to the fixed releases. A high-severity CVSS 3.1 score of 7.8 reflects the potential for code execution with high impact on confidentiality, integrity, and availability. Microsoft has issued official fixes for this vulnerability.

CVE-2026-77486 is a high-severity integer overflow vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects multiple build versions prior to specific fixed releases. An official fix is available from Microsoft.