CWE-191 · Integer Underflow (page 3)
Page 3 of 7 — CVEs classified under CWE-191, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42980 | High | 7.8 | 2026-06-09 | Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-11789 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted passwo… |
CVE-2026-49494 | High | 7.5 | 2026-06-07 | Xcitium Client Security (XCS) before 13.8.2.10019 and Comodo Internet Security (CIS) through 12.3.4.8162 (fix expected by 2026 Q3) contain an integer underflow… |
CVE-2026-50593 | High | 7.3 | 2026-06-05 | Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within… |
CVE-2026-35049 | Medium | 6.5 | 2026-06-02 | wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon receiving a crafted malicious Proteus external message with… |
CVE-2026-37231 | High | 7.5 | 2026-06-01 | FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit cou… |
CVE-2026-46107 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalan… |
CVE-2026-45999 | High | 7.1 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Some crafted images can hav… |
CVE-2026-45884 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid per-cpu hold underflow in aa_get_buffer When aa_get_buffer() pulls from t… |
CVE-2026-25104 | High | 7.8 | 2026-05-26 | A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead… |
CVE-2026-44069 | Low | 3.9 | 2026-05-21 | An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtain limited information, modify limited data… |
CVE-2026-44060 | High | 7.5 | 2026-05-21 | An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI… |
CVE-2026-8463 | Medium | 5.3 | 2026-05-13 | Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input. The auto-detect form of arg… |
CVE-2026-42268 | High | 7.5 | 2026-05-12 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandl… |
CVE-2026-34672 | Medium | 6.2 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could re… |
CVE-2026-34667 | Medium | 6.2 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could re… |
CVE-2026-40397 | High | 7.8 | 2026-05-12 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-43916 | | 2026-05-12 | pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-rea… | |
CVE-2026-43359 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set receiv… |
CVE-2026-43301 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix PM runtime usage count underflow Replace pm_runtime_put_sy… |
CVE-2026-43187 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfs: delete attr leaf freemap entries when empty Back in commit 2a2b5932db6758 ("xfs: fix… |
CVE-2026-43171 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't dump the entire memory region The current logic at cper_print_fw_err() do… |
CVE-2026-37459 | High | 7.5 | 2026-05-04 | An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE messa… |
CVE-2026-7736 | High | 7.3 | 2026-05-04 | A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Execu… |
CVE-2026-37534 | Critical | 9.8 | 2026-05-01 | Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transport_Protocol_Data_T… |
CVE-2026-33845 | High | 7.5 | 2026-04-30 | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and… |
CVE-2026-7424 | High | 8.1 | 2026-04-29 | Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 a… |
CVE-2026-7423 | Medium | 5.3 | 2026-04-29 | Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of… |
CVE-2026-41499 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based… |
CVE-2026-26204 | Medium | 4.4 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-… |
CVE-2026-6914 | Medium | 6.5 | 2026-04-29 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoD… |
CVE-2026-40356 | Medium | 5.9 | 2026-04-28 | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on… |
CVE-2026-31662 | High | 7.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_gr… |
CVE-2026-31656 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat A use-after-free / ref… |
CVE-2026-31617 | Medium | 5.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read fro… |
CVE-2026-31551 | Medium | 5.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. syzbot reported static… |
CVE-2026-28525 | Medium | 6.8 | 2026-04-23 | SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a de… |
CVE-2026-33999 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local… |
CVE-2026-34064 | Medium | 5.3 | 2026-04-22 | nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingContract::can_change_balance` returns `Acc… |
CVE-2026-5720 | Critical | 9.1 | 2026-04-17 | miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information dis… |
CVE-2026-27297 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execut… |
CVE-2026-27296 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execut… |
CVE-2026-32149 | High | 7.3 | 2026-04-14 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-27907 | High | 7.8 | 2026-04-14 | Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-33899 | Medium | 5.3 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses… |
CVE-2026-31417 | High | 7.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix overflow when accumulating packets Add a check to ensure that `x25_sock.frag… |
CVE-2026-40386 | Medium | 4.0 | 2026-04-12 | In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak informatio… |
CVE-2026-5188 | High | 8.1 | 2026-04-10 | An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can speci… |
CVE-2026-5778 | Medium | 6.5 | 2026-04-09 | Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter… |
CVE-2026-39855 | Medium | 5.5 | 2026-04-09 | osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version… |
CVE-2026-39314 | Medium | 4.0 | 2026-04-07 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnera… |
CVE-2026-33184 | High | 7.5 | 2026-04-03 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, the d… |
CVE-2026-34165 | Medium | 5.0 | 2026-03-31 | go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in whic… |
CVE-2026-25075 | High | 7.5 | 2026-03-23 | strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to… |
CVE-2026-1005 | Medium | 5.3 | 2026-03-19 | Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacker to cause a buffer overflow in the AEAD decryption path by injecting a TLS record shorte… |
CVE-2026-2369 | Medium | 6.5 | 2026-03-19 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This… |
CVE-2026-25772 | Medium | 4.9 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.14.3, a stack-ba… |
CVE-2026-3084 | High | 7.8 | 2026-03-16 | GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2026-32775 | High | 7.4 | 2026-03-16 | libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be over… |
CVE-2026-31883 | Medium | 6.5 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap… |
CVE-2026-29776 | Low | 3.1 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Cor… |
CVE-2026-29078 | High | 7.5 | 2026-03-13 | Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The st… |
CVE-2026-3538 | High | 8.8 | 2026-03-04 | Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
CVE-2026-27596 | High | 7.5 | 2026-03-02 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-… |
CVE-2026-23748 | Low | 3.7 | 2026-02-26 | Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a… |
CVE-2026-27710 | Medium | 5.0 | 2026-02-26 | NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a denial-of-service vulnerability exist… |
CVE-2026-3172 | High | 8.1 | 2026-02-25 | Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the da… |
CVE-2025-14547 | | 2026-02-20 | An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the und… | |
CVE-2025-14055 | | 2026-02-20 | An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet. | |
CVE-2025-48021 | Medium | 6.5 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets… |
CVE-2025-1924 | High | 8.2 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receive maliciously crafted packets… |
CVE-2026-25532 | Medium | 6.3 | 2026-02-04 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (… |
CVE-2026-23069 | Medium | 5.5 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calcula… |
CVE-2026-23951 | Medium | 5.5 | 2026-01-22 | SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, cau… |
CVE-2025-62291 | High | 8.1 | 2026-01-16 | In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause… |
CVE-2026-20957 | High | 7.8 | 2026-01-13 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-22185 | | 2026-01-07 | OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline(… | |
CVE-2026-21489 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have Out-of-bounds Read and Integer Und… |
CVE-2025-10933 | | 2026-01-05 | An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads. | |
CVE-2025-67269 | High | 7.5 | 2026-01-02 | An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67… |
CVE-2025-62567 | Medium | 5.3 | 2025-12-09 | Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network. |
CVE-2025-66217 | High | 7.5 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This v… |
CVE-2025-59368 | | 2025-11-25 | An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, poten… | |
CVE-2025-11931 | High | 8.2 | 2025-11-21 | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_… |
CVE-2025-65092 | | 2025-11-21 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder… | |
CVE-2025-64076 | High | 7.5 | 2025-11-18 | Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1)… |
CVE-2025-61835 | High | 7.8 | 2025-11-11 | Substance3D - Stager versions 3.1.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exe… |
CVE-2025-61836 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-61826 | High | 7.8 | 2025-11-11 | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-62594 | Medium | 4.7 | 2025-10-27 | ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service d… |
CVE-2025-55096 | Medium | 6.1 | 2025-10-17 | In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_hid_report_descrip… |
CVE-2025-62495 | High | 8.8 | 2025-10-16 | An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size… |
CVE-2025-59242 | High | 7.8 | 2025-10-14 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2023-53679 | High | 8.3 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt7601u: fix an integer underflow Fix an integer underflow that leads to a null poi… |
CVE-2025-39928 | High | 7.1 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the… |
CVE-2025-55118 | High | 8.9 | 2025-09-16 | Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: *… |
CVE-2023-53258 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix possible underflow for displays with large vblank [Why] Underflow ob… |
CVE-2023-53226 | High | 8.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mg… |
CVE-2023-53189 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer()… |
CVE-2025-23335 | Medium | 4.4 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker could cause an underflow by a specific… |