A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.
Security Fix(es):
* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
* xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing. (CVE-2026-34000)
* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
* xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling (CVE-2026-34002)
* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)
* TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions (CVE-2026-34352)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-46597 is a high-severity integer underflow vulnerability in the golang.org/x/crypto/ssh package. It is caused by an incorrect cast from bytes to int, leading to a server-side panic in the AES-GCM packet decoder when processing crafted inputs. This vulnerability results in a denial of service but does not impact confidentiality or integrity. There is no confirmed patch or official remediation available at this time. No known exploits have been reported in the wild. Users should monitor vendor advisories for updates.
CVE-2026-8463 is a medium severity vulnerability in LEONT's Crypt::Argon2 Perl module versions from 0.017 before 0.031. It involves a heap out-of-bounds read in the argon2_verify function when processing an empty encoded input string. This occurs because the function passes encoded_len - 1 to memchr without verifying that encoded_len is non-zero, causing an underflow and resulting in memory beyond the heap being read. This can lead to process crashes or unintended information disclosure related to adjacent memory content. No official patch or remediation guidance is currently available from the vendor.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-43916 is a high-severity vulnerability in the pam_authnft module of identd-ng versions prior to 0.2.0-alpha. It involves a heap buffer over-read caused by improper handling of crafted NETLINK_SOCK_DIAG replies in the peer_lookup_tcp function. This flaw allows reading beyond allocated memory boundaries, potentially leading to information disclosure or application instability. The vulnerability has been fixed in version 0.2.0-alpha. No known exploits are reported in the wild at this time.
CVE-2026-7424 is an integer underflow vulnerability in the DHCPv6 sub-option parser of AWS FreeRTOS-Plus-TCP versions before 4.2.6 and 4.4.1. This flaw allows an adjacent network actor to corrupt IPv6 address assignment, DNS configuration, and lease times, and can cause a denial of service by freezing the IP task, requiring a hardware reset. The issue affects devices with DHCPv6 enabled. AWS has released fixed versions 4.2.6 and 4.4.1 to address this vulnerability.
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB.
To mitigate this issue, users should upgrade to the fixed version when available.
A heap-based out-of-bounds write vulnerability exists in Wazuh versions from 1.0.0 up to but not including 4.14.4. The flaw occurs in the GetAlertData function where a NULL byte is written one byte before the start of a buffer allocated by strdup due to unsigned integer underflow and pointer arithmetic wrapping. This corrupts heap metadata and can be exploited by a malicious actor with high privileges on a compromised agent to cause denial of service or heap corruption by injecting a crafted alert into the alerts log file monitored by wazuh-logcollector. The issue is fixed in version 4.14.4.
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server.
This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32
CVE-2026-40356 is an integer underflow vulnerability in MIT Kerberos 5 versions before 1.22.3. It occurs when gss_accept_sec_context() is called on a system with a NegoEx mechanism registered, causing an out-of-bounds read. An unauthenticated remote attacker can trigger this, potentially causing the affected process to terminate unexpectedly. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read past the allocated receive buffer to a local IPC socket.
CVE-2026-34064 is an integer underflow vulnerability in the nimiq-account Rust implementation prior to version 1.3.0. The issue occurs in the VestingContract::can_change_balance function, where an underflow panic can crash the node if an attacker creates a vesting contract with a total_amount exceeding the actual contract balance. This leads to a panic during mempool admission and block processing when an outgoing transaction triggers the vulnerable code path. The vulnerability has a medium severity with a CVSS score of 5.3. A patch fixing this issue is included in version 1.3.0.
miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.
Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.