FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
CVE-2026-112109 is a local privilege escalation vulnerability in Thales SafeNet Authentication Client Service (SACSrv). It allows an authenticated, non-administrator local user to trigger a heap-based buffer overflow via the service interface. Exploitation can lead to arbitrary code execution with Local System privileges. This affects SAC versions up to and including 10.9 R3 GA (build 10.9.7449).
musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.
An integer overflow vulnerability in the Samsung Exynos NPU kernel driver for the Exynos 2100 chipset allows an unprivileged application to cause memory corruption. This flaw is identified as CWE-190 and affects version 0 of the product. A fix was released in November 2026.
CVE-2026-69005 is an integer overflow vulnerability in the NPU driver parameter processing of the Samsung Semiconductor Exynos 1480 chipset. The flaw arises from insufficient bounds checking, which can lead to integer overflow or wraparound conditions. A fix for this vulnerability was released in November 2026.
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
CVE-2026-18142 is an integer overflow vulnerability in IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD. This flaw could allow a remote authenticated attacker to cause a denial of service and limited memory corruption. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity. No public exploits or patches are currently documented.
A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.
Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.
An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file, potentially resulting in denial of service (DoS).
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920.
CVE-2026-119340 is an integer overflow or wraparound vulnerability in the Tesseract OCR engine prior to version 5.5.4. The flaw occurs in the GENERIC_2D_ARRAY::DeSerializeSize function, which reads matrix dimensions as signed 32-bit integers but only compares them against UINT16_MAX. This allows negative or excessively large dimension values to cause inconsistent memory allocation states, leading to out-of-bounds accesses when loading a crafted traineddata file. The issue can cause denial of service by crashing the application. The vulnerability is fixed in Tesseract version 5.5.4.
CVE-2026-61694 is an integer overflow vulnerability in the LeJamon go-xrpl library, a Go implementation of the XRP Ledger protocol. The flaw occurs in the ParseMPTAmountBinary function, which converts an eight-byte magnitude to int64 without checking for overflow, causing large positive values to wrap into negative amounts silently. This leads to incorrect escrow amount calculations and divergence from the reference implementation. The vulnerability affects versions up to the June 18, 2026 revision. A source code fix is available in a specific commit.
CVE-2026-116366 is a critical integer overflow or wraparound vulnerability in ClickHouse Server that allows an unauthenticated network attacker to execute arbitrary code. Multiple versions of ClickHouse prior to fixed releases are affected. The vulnerability has a high CVSS 4.0 score of 9.5, indicating severe impact if exploited. Fixed versions are available, and no known exploits are currently reported in the wild.
CVE-2026-19199 is a high-severity integer overflow vulnerability in Imagination Technologies Graphics DDK. It involves a 32-bit integer overflow in the kernel mode driver during page-to-byte conversion for memory allocation, causing undersized kernel buffer allocation. This flaw can lead to mapping of unallocated or previously allocated physical pages into an attacker-controlled GPU MMU context, potentially disclosing sensitive kernel data. The vulnerability affects software running as a non-privileged user. No specific affected versions or patches are provided.
CVE-2026-18629 is an integer overflow vulnerability in Imagination Technologies Graphics DDK. It occurs when unusual GPU shader code triggers arithmetic operations that overflow, causing incorrect memory size calculations. This can lead to memory allocation failures and subsequent dereferencing of NULL pointers, crashing the GPU compiler process. On some platforms where the compiler runs with system privileges, this crash could potentially enable further exploits. The vulnerability has a high severity score of 7.5 and impacts availability by causing crashes.
MariaDB Connector/J versions from 3.0.0 up to but excluding 3.3.7, 3.4.5, and 3.5.10 contain a vulnerability in length parameter handling. The issue arises because certain methods improperly convert an unsigned 8-byte length-encoded integer to a Java int without verifying that the value fits within a non-negative integer range. This can cause negative array sizes, out-of-bounds errors, or excessive memory allocation when processing data from a malicious or compromised server or a man-in-the-middle attacker. The vulnerability is fixed in versions 3.3.7, 3.4.5, and 3.5.10.