Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 759

Export CSV
CVE-2026-123375

Microsoft Office Outlook Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2021 Office 2024
CVE-2026-86566

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 3 more
CVE-2026-54982

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more
CVE-2026-49790

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more
CVE-2026-50498

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more
CVE-2026-69276

Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-90996

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Red Hat Redhat and 1 more
Products
Sssd Enterprise Linux Enterprise Linux and 4 more
CVE-2026-58016

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib Cert-manager Operator Cert Manager and 22 more
CVE-2026-80303

Avast WFP stream parser integer underflow causes system crash

An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value. The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-115928

FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_core_media_add_crypto() passed the encoded key and salt length from an inbound SDP a=crypto attribute to switch_b64_decode() as the destination capacity. A zero-length key and salt made that capacity underflow, allowing the decoded attribute to overflow a fixed stack buffer with sender-chosen bytes before the call was answered. On the shipped external profile, an unauthenticated caller can reach the SDES-SRTP parser, while profiles that challenge inbound calls remain affected for senders who can authenticate; setting rtp_secure_media_inbound to false removes the path, and WebRTC DTLS-SRTP legs are unaffected. The overflow corrupts memory and can crash the FreeSWITCH process, dropping every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Freeswitch Signalwire
Products
Freeswitch Freeswitch
CVE-2026-116568

FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Freeswitch Signalwire
Products
Freeswitch Freeswitch
CVE-2026-116569

FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short segment whose MSRP byte range ended in * without first proving the segment was long enough. The unsigned result wrapped near SIZE_MAX and reached switch_msrp_msg_set_payload() as both an allocation size and memcpy length, while related pointer arithmetic could read before the receive buffer. The listener is disabled by default in msrp.conf.xml, but any deployment enabling an MSRP TCP or TLS port parses this framing before authentication. An unauthenticated network peer can corrupt memory and crash FreeSWITCH, dropping all active calls, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Freeswitch Signalwire
Products
Freeswitch Freeswitch