jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
### Summary `jxl-oxide` exposes a public safe API that can construct an undersized `FrameBuffer` due to unchecked `usize
#cwe-190
共收录 699 条相关情报。
← 返回所有主题jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)
### Summary Logic bug in `decode_simple_table_slow` may cause integer arithmetic overflow when decoding Modular image wi
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder c...
CVE-2026-53466
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-
In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and uns...
CVE-2026-6682
In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap,
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.c...
CVE-2026-7838
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failu
UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes v...
CVE-2026-7828
UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/sett
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel...
CVE-2026-56363
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attacker
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON stri...
CVE-2026-54903
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vu...
CVE-2026-54900
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a la...
CVE-2026-56363
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attacker
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the pro...
CVE-2026-53432
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a...
CVE-2026-57965
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a sp
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey...
CVE-2026-58050
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey...
CVE-2026-58050
libssh2 库（版本 1.11.1 及之前）在处理 publickey-subsystem 响应时存在整数溢出漏洞。攻击者控制的 SSH 服务器可以在响应中设置一个 32 位的属性计数（num_attrs），libssh2 客户端在分配
The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large...
CVE-2026-49416
The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer
The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a h...
CVE-2026-49416
CVE-2026-49416 是 FreeBSD 或类似 Unix 系统内核中 vt(4) 设备驱动的 CONS_HISTORY ioctl 处理程序存在的一个严重漏洞。该处理程序在接收用户请求的历史记录大小时，未进行充分的验证。当用户提供
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a la...
CVE-2026-45258
CVE-2026-45258 是 Linux 内核音频子系统 /dev/dsp 设备驱动中的一个整数溢出漏洞。该漏洞位于 dsp_mmap_single() 函数中，该函数负责验证用户请求的内存映射。具体而言，函数通过将用户提供的偏移量（o
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(...
CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2Gi
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release li...
CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2Gi
golang.org/x/crypto/ssh vulnerable to infinite loop on large channel writes
CVE-2026-39834
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload