Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire described a different name than the one the application asked to encode. RFC 1035 section 2.3.4

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire described a different name than the one the application asked to encode. RFC 1035 section 2.3.4

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer.  M

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size pat

Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 relea

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer. In fixed versions such ov

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulner

Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.

In uriparser before 1.0.2, there is pointer difference truncation to int in various places.

uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.