CWE-369 vulnerabilities

Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.

NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.

A divide-by-zero vulnerability exists in the HappySeaFox sail library prior to version 1.0.2. The issue occurs in the built-in WebP decoder during initialization when processing malformed animated WebP files with inconsistent metadata. This flaw can cause a crash and denial of service in applications that load untrusted WebP images using the affected codec. The vulnerability is fixed in version 1.0.2.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a divide by zero. A successful exploit of this vulnerability might lead to denial of service.

In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash.

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.

CVE-2026-16897 is a medium severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a divide-by-zero condition (CWE-369) that can be triggered by a local attacker, potentially causing a denial of service via an out-of-bounds write.

CVE-2026-63117 is a divide-by-zero vulnerability in FreeRDP prior to version 3.28.0. An authenticated RDP client can trigger a calculation that results in division by zero in the server-side rdpsnd channel, causing the process to terminate unexpectedly. This issue is fixed in FreeRDP 3.28.0.

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function.

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g.  dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files.  If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.

Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org. This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.

A divide-by-zero vulnerability exists in HDF5 through version 2.3.0 due to improper validation of chunk-layout dimensionality against dataspace rank when opening an existing dataset. This can cause a denial of service via application crash when processing a crafted HDF5 file.

CVE-2026-61378 is a divide-by-zero vulnerability in AutomationDirect's Productivity Suite. This flaw allows a local attacker to cause a division by zero, resulting in a system crash. The vulnerability does not impact confidentiality or integrity but causes a denial of service. No patch or official remediation has been confirmed yet. The vulnerability has a medium severity rating with a CVSS score of 5.5.

FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-delivered update media can make this remote in some pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

CVE-2026-46469 is a medium severity vulnerability in GStreamer's gst-plugins-good before version 1.28.2. The vulnerability exists in the isomp4 plugin's qtdemux_parse_trak function, which does not properly validate MP4 atom data before performing division operations. This can lead to an integer division by zero, causing a denial of service. The issue affects local attackers and does not impact confidentiality or integrity. No official patch or remediation guidance is currently confirmed.

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero. The parser uses this attacker-controlled value as a divisor without validation, causing an immediate hardware trap and process crash. This vulnerability is fixed in 6.0.1698.0.