Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,631

Export CSV
CVE-2009-3609

xpdf/poppler: ImageStream:: ImageStream integer overflow

Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Foolabs Glyph And Cog Glyphandcog and 4 more
Products
Xpdf Pdftops Xpdfreader and 4 more
CVE-2009-1438

libmodplug: Integer overflow in the MED files loading routine

Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.

CVSS 2.0 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Konstanty Bialkowski
Products
Libmodplug
CVE-2009-2412

apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 10.0 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache Redhat
Products
Apr-util Portable Runtime Certificate System and 2 more
CVE-2009-3296

ocaml-camlimages: TIFF reader multiple integer overflows

Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing large width and height values that trigger heap-based buffer overflows.

CVSS 2.0 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Gallium.inria
Products
Camimages
CVE-2009-3603

xpdf/poppler: SplashBitmap:: SplashBitmap integer overflow

Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188.

CVSS 2.0 · 9.3 Critical EPSS 8.6% KEV · Not listed
Vendors
Foolabs Glyphandcog Poppler and 1 more
Products
Xpdf Xpdfreader Poppler and 1 more
CVE-2009-3604

xpdf/poppler: Splash:: drawImage integer overflow and missing allocation return value check

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 8.7% KEV · Not listed
Vendors
Foolabs Glyphandcog Gnome and 3 more
Products
Xpdf Xpdfreader Gpdf and 3 more
CVE-2009-3605

xpdf: multiple integer overflows

Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/. NOTE: this may overlap CVE-2009-0791.

CVSS 2.0 · 6.8 Medium EPSS 4.4% KEV · Not listed
Vendors
Poppler
Products
Poppler
CVE-2009-3606

xpdf/poppler: PSOutputDev:: doImageL1Sep integer overflow

Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 8.6% KEV · Not listed
Vendors
Foolabs Glyphandcog Kde and 2 more
Products
Xpdf Xpdfreader Kpdf and 2 more
CVE-2009-3608

xpdf/poppler: integer overflow in ObjectStream::ObjectStream (oCERT-2009-016)

Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 10.2% KEV · Not listed
Vendors
Foolabs Glyph And Cog Glyphandcog and 5 more
Products
Xpdf Pdftops Xpdfreader and 5 more
CVE-2009-0200

OpenOffice.org Word document Integer Underflow

Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 6.7% KEV · Not listed
Vendors
Openoffice Redhat
Products
Openoffice.org Enterprise Linux
CVE-2009-0583

argyllcms: Multiple integer overflows in the International Color Consortium Format Library

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Argyllcms Ghostscript Redhat
Products
Argyllcms Ghostscript Enterprise Linux
CVE-2009-0585

libsoup: integer overflow in soup_base64_encode()

Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.

CVSS 2.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Joe Shaw Redhat
Products
Libsoup Enterprise Linux
CVE-2009-0586

gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()

Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Canonical Gstreamer Redhat
Products
Ubuntu Linux Gstreamer Enterprise Linux
CVE-2026-3707

MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow

A vulnerability was identified in MrNanko webp4j up to 1.3.x. The affected element is the function DecodeGifFromMemory of the file src/main/c/gif_decoder.c. Such manipulation of the argument canvas_height leads to integer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 89771b201c66d15d29e4cc016d8aae82b6a5fbe1. It is advisable to implement a patch to correct this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mrnanko
Products
Webp4j
CVE-2026-39886

OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl()

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Versions 3.4.0 through 3.4.9 have a signed integer overflow vulnerability in OpenEXR's HTJ2K (High-Throughput JPEG 2000) decompression path. The `ht_undo_impl()` function in `src/lib/OpenEXRCore/internal_ht.cpp` accumulates a bytes-per-line value (`bpl`) using a 32-bit signed integer with no overflow guard. A crafted EXR file with 16,385 FLOAT channels at the HTJ2K maximum width of 32,767 causes `bpl` to overflow `INT_MAX`, producing undefined behavior confirmed by UBSan. On an allocator-permissive host where the required ~64 GB allocation succeeds, the wrapped negative `bpl` value would subsequently be used as a per-scanline pointer advance, which would produce a heap out-of-bounds write. On a memory-constrained host, the allocation fails before `ht_undo_impl()` is entered. This is the second distinct integer overflow in `ht_undo_impl()`. CVE-2026-34545 addressed a different overflow in the same function — the `int16_t p` pixel-loop counter at line ~302 that overflows when iterating over channels whose `width` exceeds 32,767. The CVE-2026-34545 fix did not touch the `int bpl` accumulator at line 211, which is the subject of this advisory. The `bpl` accumulator was also not addressed by any of the 8 advisories in the 2026-04-05 v3.4.9 release batch. This finding is structurally identical to CVE-2026-34588 (PIZ `wcount*nx` overflow in `internal_piz.c`) and should be remediated with the same pattern. The CVE-2026-34588 fix did not touch `internal_ht.cpp`. Version 3.4.10 contains a remediation that addresses the vulnerability in `internal_ht.cpp`.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Academysoftwarefoundation Openexr
Products
Openexr Openexr
CVE-2017-20230

Storable versions before 3.05 for Perl has a stack overflow

Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Nwclark
Products
Storable
CVE-2026-6773

Denial-of-service due to integer overflow in the Graphics: WebGPU component

Denial-of-service due to integer overflow in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2015-8651

flash-plugin: multiple code execution issues fixed in APSB16-01

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 8.8 High EPSS 67.7% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Air Air Sdk Air Sdk \& Compiler and 20 more
CVE-2016-1010

flash-plugin: multiple code execution issues fixed in APSB16-08

Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.

CVSS 3.1 · 8.8 High EPSS 19.3% KEV · Listed
Vendors
Adobe Apple Google and 4 more
Products
Air Air Desktop Runtime Air Sdk and 13 more
CVE-2013-2729

acroread: multiple code execution flaws (APSB13-15)

Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

CVSS 3.1 · 8.8 High EPSS 66.6% KEV · Listed
Vendors
Adobe Redhat Suse
Products
Acrobat Acrobat Reader Enterprise Linux Desktop and 6 more