Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 762

Export CSV
CVE-2026-37534

Integer underflow in Open‑SAE‑J1939 allows arbitrary memory write via crafted CAN frames

Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transport_Protocol_Data_Transfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Danielmartensson
Products
Open-sae-j1939
CVE-2026-7423

Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon
Products
Freertos-plus-tcp
CVE-2026-7424

Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) by sending a single crafted DHCPv6 packet. The issue is present whenever DHCPv6 is enabled. To mitigate this issue, users should upgrade to version V4.2.6 or V4.4.1 or newer.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Amazon
Products
Freertos-plus-tcp
CVE-2026-41499

Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wazuh
Products
Wazuh
CVE-2026-26204

Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wazuh
Products
Wazuh
CVE-2026-1005

Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path

Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacker to cause a buffer overflow in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by ssl_DecodePacket. The underflow wraps a 16-bit length to a large value that is passed to AEAD decryption routines, causing heap buffer overflow and a crash. An unauthenticated attacker can trigger this remotely via malformed TLS Application Data records.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Wolfssl
Products
Wolfssl
CVE-2026-5778

Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path.

Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by ssl_DecodePacket. The underflow wraps a 16-bit length to a large value that is passed to AEAD decryption routines, causing a large out-of-bounds read and crash. An unauthenticated attacker can trigger this remotely via malformed TLS Application Data records.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Wolfssl
Products
Wolfssl
CVE-2026-5188

Integer underflow in X.509 SAN parsing in wolfSSL

An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This results in incorrect handling of certificate data. The issue is limited to configurations using the original ASN.1 parsing implementation which is off by default.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Wolfssl
Products
Wolfssl
CVE-2026-40356

krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2026-34064

nimiq-account: Vesting insufficient funds error can panic

nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingContract::can_change_balance` returns `AccountError::InsufficientFunds` when `new_balance < min_cap`, but it constructs the error using `balance: self.balance - min_cap`. `Coin::sub` panics on underflow, so if an attacker can reach a state where `min_cap > balance`, the node crashes while trying to return an error. The `min_cap > balance` precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding `total_amount` without validating `total_amount <= transaction.value` (the real contract balance). After creating such a vesting contract, the attacker can broadcast an outgoing transaction to trigger the panic during mempool admission and block processing. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nimiq
Products
Nimiq-account Nimiq Proof-of-stake
CVE-2025-14055

Integer underflow in Secure NCP host

An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Simplicity Sdk
CVE-2026-27907

Windows Storage Spaces Controller Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 22h3 Windows 11 23h2 Windows 11 23h2 and 11 more
CVE-2007-0063

security flaw

Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.

CVSS 2.0 · 10.0 Critical EPSS 20.4% KEV · Not listed
Vendors
Canonical Redhat Vmware
Products
Ubuntu Linux Enterprise Linux Ace and 4 more
CVE-2014-0497

flash-plugin: integer underflow flaw leads to arbitrary code execution (APSB14-04)

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 8.8 High EPSS 99.9% KEV · Listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Mac Os X Macos and 12 more
CVE-2026-32775

libexif: libexif: Buffer overwrite via integer underflow in MakerNotes decoding

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Libexif Libexif Project
Products
Libexif Libexif
CVE-2026-23951

SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting in an out-of-bounds heap read that crashes the app. There are no published fixes at the time of publication.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sumatrapdfreader
Products
Sumatrapdf
CVE-2026-3172

pgvector buffer overflow in parallel HNSW index build

Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Pgvector
Products
Pgvector
CVE-2026-21489

iccDEV has Out-of-bounds Read and Integer Underflow (Wrap or Wraparound)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have Out-of-bounds Read and Integer Underflow (Wrap or Wraparound) vulnerabilities in its CIccCalculatorFunc::SequenceNeedTempReset function. This issue is fixed in version 2.3.1.2.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev