CWE-191 · Integer Underflow (page 2)
Page 2 of 6 — CVEs classified under CWE-191, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7424 | High | 8.1 | 2026-04-29 | Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 a… |
CVE-2026-7423 | Medium | 5.3 | 2026-04-29 | Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of… |
CVE-2026-41499 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based… |
CVE-2026-26204 | Medium | 4.4 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-… |
CVE-2026-6914 | Medium | 6.5 | 2026-04-29 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoD… |
CVE-2026-40356 | Medium | 5.9 | 2026-04-28 | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on… |
CVE-2026-31662 | High | 7.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_gr… |
CVE-2026-31656 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat A use-after-free / ref… |
CVE-2026-31617 | Medium | 5.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read fro… |
CVE-2026-31551 | Medium | 5.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. syzbot reported static… |
CVE-2026-28525 | Medium | 6.8 | 2026-04-23 | SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a de… |
CVE-2026-33999 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local… |
CVE-2026-34064 | Medium | 5.3 | 2026-04-22 | nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingContract::can_change_balance` returns `Acc… |
CVE-2026-5720 | Critical | 9.1 | 2026-04-17 | miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information dis… |
CVE-2026-27297 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execut… |
CVE-2026-27296 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execut… |
CVE-2026-32149 | High | 7.3 | 2026-04-14 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-27907 | High | 7.8 | 2026-04-14 | Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-33899 | Medium | 5.3 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses… |
CVE-2026-31417 | High | 7.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix overflow when accumulating packets Add a check to ensure that `x25_sock.frag… |
CVE-2026-40386 | Medium | 4.0 | 2026-04-12 | In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak informatio… |
CVE-2026-5188 | High | 8.1 | 2026-04-10 | An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can speci… |
CVE-2026-5778 | Medium | 6.5 | 2026-04-09 | Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter… |
CVE-2026-39855 | Medium | 5.5 | 2026-04-09 | osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version… |
CVE-2026-39314 | Medium | 4.0 | 2026-04-07 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnera… |
CVE-2026-33184 | High | 7.5 | 2026-04-03 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, the d… |
CVE-2026-34165 | Medium | 5.0 | 2026-03-31 | go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in whic… |
CVE-2026-25075 | High | 7.5 | 2026-03-23 | strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to… |
CVE-2026-1005 | Medium | 5.3 | 2026-03-19 | Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacker to cause a buffer overflow in the AEAD decryption path by injecting a TLS record shorte… |
CVE-2026-2369 | Medium | 6.5 | 2026-03-19 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This… |
CVE-2026-25772 | Medium | 4.9 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.14.3, a stack-ba… |
CVE-2026-3084 | High | 7.8 | 2026-03-16 | GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2026-32775 | High | 7.4 | 2026-03-16 | libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be over… |
CVE-2026-31883 | Medium | 6.5 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap… |
CVE-2026-29776 | Low | 3.1 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Cor… |
CVE-2026-29078 | High | 7.5 | 2026-03-13 | Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The st… |
CVE-2026-3538 | High | 8.8 | 2026-03-04 | Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
CVE-2026-27596 | High | 7.5 | 2026-03-02 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-… |
CVE-2026-23748 | Low | 3.7 | 2026-02-26 | Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a… |
CVE-2026-27710 | Medium | 5.0 | 2026-02-26 | NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a denial-of-service vulnerability exist… |
CVE-2026-3172 | High | 8.1 | 2026-02-25 | Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the da… |
CVE-2025-14547 | | 2026-02-20 | An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the und… | |
CVE-2025-14055 | | 2026-02-20 | An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet. | |
CVE-2025-48021 | Medium | 6.5 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets… |
CVE-2025-1924 | High | 8.2 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receive maliciously crafted packets… |
CVE-2026-25532 | Medium | 6.3 | 2026-02-04 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (… |
CVE-2026-23069 | Medium | 5.5 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calcula… |
CVE-2026-23951 | Medium | 5.5 | 2026-01-22 | SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, cau… |
CVE-2025-62291 | High | 8.1 | 2026-01-16 | In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause… |
CVE-2026-20957 | High | 7.8 | 2026-01-13 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-22185 | | 2026-01-07 | OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline(… | |
CVE-2026-21489 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have Out-of-bounds Read and Integer Und… |
CVE-2025-10933 | | 2026-01-05 | An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads. | |
CVE-2025-67269 | High | 7.5 | 2026-01-02 | An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67… |
CVE-2025-62567 | Medium | 5.3 | 2025-12-09 | Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network. |
CVE-2025-66217 | High | 7.5 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This v… |
CVE-2025-59368 | | 2025-11-25 | An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, poten… | |
CVE-2025-11931 | High | 8.2 | 2025-11-21 | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_… |
CVE-2025-65092 | | 2025-11-21 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder… | |
CVE-2025-64076 | High | 7.5 | 2025-11-18 | Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1)… |
CVE-2025-61835 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exe… |
CVE-2025-61836 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-61826 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-62594 | Medium | 4.7 | 2025-10-27 | ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service d… |
CVE-2025-55096 | Medium | 6.1 | 2025-10-17 | In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_hid_report_descrip… |
CVE-2025-62495 | High | 8.8 | 2025-10-16 | An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size… |
CVE-2025-59242 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2023-53679 | High | 8.3 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt7601u: fix an integer underflow Fix an integer underflow that leads to a null poi… |
CVE-2025-39928 | High | 7.1 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the… |
CVE-2025-55118 | High | 8.9 | 2025-09-16 | Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: *… |
CVE-2023-53258 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix possible underflow for displays with large vblank [Why] Underflow ob… |
CVE-2023-53226 | High | 8.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mg… |
CVE-2023-53189 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer()… |
CVE-2025-23335 | Medium | 4.4 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker could cause an underflow by a specific… |
CVE-2025-38463 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation Syzkaller reported a bug [1] w… |
CVE-2025-3947 | High | 8.2 | 2025-07-10 | The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit th… |
CVE-2025-2523 | Critical | 9.4 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker cou… |
CVE-2025-47130 | High | 7.8 | 2025-07-08 | Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary cod… |
CVE-2025-47128 | High | 7.8 | 2025-07-08 | Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary cod… |
CVE-2025-47097 | High | 7.8 | 2025-07-08 | InCopy versions 20.3, 19.5.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution… |
CVE-2025-49532 | High | 7.8 | 2025-07-08 | Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exe… |
CVE-2025-47136 | High | 7.8 | 2025-07-08 | InDesign Desktop versions 19.5.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execut… |
CVE-2025-49744 | High | 7.0 | 2025-07-08 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2025-47996 | High | 7.8 | 2025-07-08 | Integer underflow (wrap or wraparound) in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-38200 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a s… |
CVE-2025-38161 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if… |
CVE-2023-28902 | Low | 3.3 | 2025-06-28 | An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-servic… |
CVE-2025-1991 | High | 7.5 | 2025-06-28 | IBM Informix Dynamic Server 12.10,14.10, and15.0 could allow a remote attacker to cause a denial of service due to an integer underflow when processing packets. |
CVE-2025-52471 | Critical | 9.8 | 2025-06-24 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. An integer underflow vulnerability has been identified in the ESP-NOW protocol impleme… |
CVE-2022-50036 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: dsi: Prevent underflow when computing packet sizes Currently, the packet overh… |
CVE-2024-54028 | High | 8.4 | 2025-06-02 | An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-ba… |
CVE-2025-49112 | Low | 3.1 | 2025-06-02 | setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used. |
CVE-2025-4948 | High | 7.5 | 2025-05-19 | A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handl… |
CVE-2025-30668 | Medium | 6.5 | 2025-05-14 | Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-43555 | High | 7.8 | 2025-05-13 | Animate versions 24.0.8, 23.0.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execut… |
CVE-2025-43546 | High | 7.8 | 2025-05-13 | Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executio… |
CVE-2025-30324 | High | 7.8 | 2025-05-13 | Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary cod… |
CVE-2025-29974 | Medium | 5.7 | 2025-05-13 | Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2025-47256 | Medium | 5.6 | 2025-05-06 | Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file. |
CVE-2025-26269 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that re… |