CWE-189 vulnerabilities

CVE-2026-102804 is an integer overflow vulnerability in the hexwave_init function of the stb_hexwave.h library within Nothings stb. The flaw occurs due to improper handling of the width or oversample arguments, which can lead to integer overflow. Remote exploitation is possible, and public exploit code is available. The vulnerability has a medium severity with a CVSS score of 6.5. The project has been notified but has not yet issued a patch or response.

CVE-2026-102620 is an integer overflow vulnerability in Freedesktop Poppler versions 26.06.0, 26.07.0, and 26.08.0. It affects the function FoFiTrueType::cvtSfnts in the source file fofi/FoFiTrueType.cc. The vulnerability can be exploited only locally and has a medium severity score of 4.8. A patch identified by commit 245d3c6823377755f2c1d5fdddd010279c6ed94d is available to address this issue.

A security vulnerability exists in Trusted Domain Project OpenDMARC up to version 1.4.2. The flaw is an integer overflow caused by manipulation of the 'pct' argument in the DMARC Parser component, specifically in the file libopendmarc/opendmarc_policy.c. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor has not responded to the disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.5.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle