CVE-2026-80303 is an integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows. It allows denial of service by causing a system crash through improper length calculations during network stream processing. The vulnerability can be triggered remotely via network traffic or locally via crafted data, leading to kernel panic and system crash.
CVE-2026-116788 is a heap-based buffer overflow vulnerability in FreeSWITCH before version 1.11.2. It arises from an integer underflow in the switch_xml_decode() function when processing XML documents with entities that have empty replacement values. An unauthenticated attacker can exploit this by sending a crafted SIP PUBLISH request to a SIP profile with presence management and DTD processing enabled, causing heap memory corruption and process termination, disrupting active calls. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116569 is an integer underflow vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the msrp_parse_buffer() function, which subtracts delimiter framing from a peer-controlled short segment without verifying its length, causing an unsigned integer wraparound. This leads to memory corruption and potential crashes when processing MSRP TCP or TLS connections before authentication. The listener is disabled by default, but enabling MSRP ports exposes this risk. The issue is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.
CVE-2026-115928 is a stack-based buffer overflow vulnerability in FreeSWITCH prior to version 1.11.2. It occurs in the function switch_core_media_add_crypto() when processing the encoded key and salt length from an inbound SDP a=crypto attribute. A zero-length key and salt cause an underflow in the destination capacity, leading to a buffer overflow on the stack. This overflow can corrupt memory and crash the FreeSWITCH process, dropping all active calls. The vulnerability affects the shipped external profile accessible to unauthenticated callers and authenticated inbound calls on other profiles unless mitigated by configuration. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-122992 is a critical integer underflow vulnerability in G4KLX DStarGateway and F4FXL DStarGateway before commit 7b75de6. The flaw occurs in the function dstarCallsignToAPRS in APRSUtils.cpp when processing an empty RS-MS1A sender field, leading to an integer underflow condition.
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.
CVE-2026-120058 is a high-severity out-of-bounds write vulnerability in the PostgreSQL psqlODBC driver. The driver sizes its row cache based on the initial column count from a cursor's first result but does not verify that subsequent FETCH replies have the same column count. A malicious or untrusted server can send a FETCH reply with more columns, causing the driver to write beyond allocated memory. Additionally, replies with fewer columns can cause an underflow in the unsigned field count. This issue is exploitable when UseDeclareFetch is enabled. Versions before 18.00.0006 are affected.
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920.
In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.
CVE-2026-111735 is an integer underflow vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs in the pf_cpm_c_data_ind() function when processing a received cyclic data frame in certain states. A crafted short frame causes the offset calculation to wrap around due to 16-bit arithmetic without proper length checks, leading to out-of-bounds reads. This can result in a crash (denial of service) or memory disclosure.
CVE-2026-103411 is an integer underflow vulnerability in the DhcpMessageDecoder component of Juniper Networks Session Smart Router. This flaw allows an attacker with local network access to send a malicious DHCP reply that can cause information disclosure and denial of service. The vulnerability affects multiple versions of the product prior to fixed releases. A high severity rating is assigned due to the potential impact on confidentiality and availability.
CVE-2026-82947 is a high-severity vulnerability in RT-Labs AB SOEM affecting versions before 2.0.1. It involves out-of-bounds reads caused by improper validation of length and offset values in device messages during frame processing. This flaw can lead to the master reading memory outside allocated buffers, potentially exposing sensitive information or causing application crashes. The issue is fixed in version 2.0.1.
CVE-2026-70388 is an integer underflow vulnerability in RT-Labs AB SOEM versions prior to 2.0.1. A malicious network device can send crafted messages that cause the master to write outside allocated memory boundaries by exploiting improper validation of message length arithmetic. This memory corruption may lead to arbitrary code execution on the master system. The issue is fixed in version 2.0.1.
CVE-2026-111808 is an integer underflow vulnerability in Apache Traffic Server that allows exhaustion of an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This affects multiple versions from 8.0.0 through 10.2.0. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-74755 is an integer underflow vulnerability in Apache bRPC versions prior to 1.18.0. It occurs in the mcpack2pb component when processing a string field with a zero value_size, leading to an underflow in size calculation. This causes the server process to abort due to an uncaught exception, allowing remote attackers to crash the bRPC server with a single unauthenticated request in certain deployment scenarios.
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.
Root Cause:
The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.
Affected Scenarios:
Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.
How to Fix:
(Choose one of the following options)
1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3325
Note:
The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
Eclipse OpenJ9 versions prior to 0.63.0 contain an integer underflow vulnerability in the JITServer component during DataDescriptor message deserialization. An unauthenticated remote attacker can exploit this by sending a crafted network payload that triggers an unsigned integer underflow, leading to an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing denial of service.
CVE-2026-92853 is a high-severity vulnerability in the TLS 1.3 Certificate-message parser of Eclipse Foundation's Eclipse ThreadX - NetX Duo. The parser incorrectly decrements the message length to skip a context byte without verifying that the message contains that byte. This leads to an unsigned integer wraparound when processing a zero-length Certificate message, causing the parser to read beyond the session packet buffer. The flaw can be triggered pre-authentication with a minimal four-byte handshake header and does not require cryptographic validity.
CVE-2026-49868 is a critical out-of-bounds read vulnerability in RIOT-OS affecting versions prior to 2026.07. The flaw occurs in the DHCPv6 client implementation where minimum-length validation is missing before parsing IA_PD and IA_NA option bodies. A malicious DHCPv6 server can exploit this by sending a reply with an option length smaller than expected, leading to heap memory reads beyond the option boundary. This can cause device crashes and potential memory exposure or corruption. The issue is fixed in version 2026.07.