Integer-Overflow

A vulnerability in the GIMP file-fits plugin allows for an integer overflow when processing crafted FITS image files, occurring during memory allocation calculations for width and height, which leads to an undersized heap-based buffer, and subsequent writing of pixel data to this buffer causes a heap-based buffer overflow and memory corruption, resulting in arbitrary code execution or a denial of service.

An unauthenticated remote denial-of-service vulnerability exists in the frp server's optional SSH Tunnel Gateway (frps) that allows an attacker to crash the entire frps process by sending a specially crafted five-byte message containing an integer overflow value in an SSH `exec` channel request, leading to a sustained service outage.

A signed integer overflow vulnerability, CVE-2026-66039, exists in the MACE6 audio decoder of FFmpeg versions through 8.1.2, allowing attackers to corrupt heap memory and achieve code execution by supplying a crafted CAF file with malicious bytes_per_packet and frames_per_packet values.

A vulnerability (CVE-2026-55379) in Pillow's BdfFontFile component allows attackers to craft a malicious BDF font file with oversized BBX dimensions and an empty BITMAP section, bypassing documented decompression bomb protection and causing the Image.new() function to silently allocate large amounts of memory in the C-heap, leading to resource exhaustion and denial-of-service for applications processing untrusted BDF fonts.

CVE-2026-48342 is an Integer Overflow or Wraparound vulnerability in Adobe Bridge that could enable an attacker to achieve arbitrary code execution on a victim's system if the victim opens a specially crafted malicious file, affecting versions up to 16.0.3 and 15.1.5.

A critical integer overflow vulnerability, CVE-2021-40346, in HAProxy's `htx_add_header()` function allows unauthenticated attackers to bypass access control rules by crafting HTTP requests with specific header name lengths, leading to HTTP request smuggling and unauthorized access to backend paths, for which a public exploit is available.

A critical vulnerability, CVE-2026-52834, affects the `jxl-grid` library on 32-bit platforms, where an integer overflow during length calculation while decoding a crafted JPEG XL image can lead to out-of-bounds writes, potentially resulting in arbitrary code execution.

An integer overflow vulnerability (CVE-2026-55203) in HAProxy through version 3.4.0 allows malicious FastCGI backends to desynchronize the FCGI framing parser, leading to request routing errors, response smuggling, or memory safety issues.

PgBouncer versions prior to 1.25.2 are vulnerable to an integer overflow (CVE-2026-6664), enabling unauthenticated remote attackers to trigger a denial-of-service via a crafted SCRAM authentication packet, with active exploitation reported.

Rsync versions 3.4.2 and prior contain an integer overflow vulnerability (CVE-2026-43618) in the compressed-token decoder, allowing a malicious sender to trigger out-of-bounds memory access on the receiver and disclose sensitive process memory.

A remotely reachable integer overflow in OpenTelemetry eBPF Instrumentation's (OBI) memcached text protocol parser can crash the OBI process, causing a denial of service due to unchecked arithmetic when handling large payload sizes in memcached storage commands.

CVE-2026-44673 describes an integer overflow in the lyb_read_string() function of the libyang library that can lead to a heap buffer overflow, potentially allowing for arbitrary code execution.

CVE-2026-42896 describes an integer overflow vulnerability in the Windows DWM Core Library, allowing an authorized local attacker to elevate privileges.

Adobe After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user if a victim opens a malicious file.

Pillow versions 10.3.0 through 12.1.1 are vulnerable to an out-of-bounds write in PSD image decoding/encoding due to an integer overflow when computing tile extent sums, potentially leading to arbitrary code execution.

CVE-2026-20884 is an integer overflow vulnerability in LibRaw's deflate_dng_load_raw function that leads to a heap buffer overflow when processing crafted DNG files.

A remote, unauthenticated attacker can crash applications using libp2p-gossipsub versions prior to 0.49.4 by sending a crafted PRUNE control message with a near-maximum backoff value, causing an arithmetic overflow during heartbeat processing.

An integer overflow vulnerability in Tinyproxy's HTTP chunked transfer encoding parser (versions <= 1.11.3) allows an unauthenticated remote attacker to cause a denial of service by sending a crafted chunk size that bypasses validation, leading to resource exhaustion.

A sandbox escape vulnerability, identified as CVE-2026-4690, exists in the XPCOM component of Mozilla Firefox, Firefox ESR, and Thunderbird due to incorrect boundary conditions and an integer overflow, potentially allowing an attacker to execute arbitrary code outside the sandbox.

A remote attacker can perform an out-of-bounds memory write on Google Chrome by exploiting an integer overflow in the Fonts component via a crafted HTML page in versions prior to 146.0.7680.165.

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors, allowing attackers to trigger out-of-bounds reads via crafted glTF/GLB files, leading to denial of service and potential memory disclosure.

CVE-2026-41445 is a reported integer overflow vulnerability in the KissFFT library that could lead to a heap buffer overflow.

An integer overflow in the `smallbitvec` crate leads to an undersized heap allocation, enabling heap buffer overflows through safe APIs, affecting versions 1.0.1 through 2.6.0.

Phpseclib versions 3.0.0 before 3.0.34 are vulnerable to an integer overflow when loading untrusted ASN.1 files, such as X.509 certificates and RSA PKCS8 keys, potentially leading to denial of service or remote code execution.

Libsixel versions 1.8.7 and prior contain an integer overflow vulnerability in the `--crop` option of `img2sixel`, leading to an out-of-bounds heap read, potentially causing a crash and information disclosure.