CWE-191
CVEs classified under CWE-191, newest first.
198 CVEsRSS
CVE-2026-70388High· 8.3Memory Corruption via Integer Underflow in Message Length Validation
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic…
CVE-2026-82947High· 7.1Multiple Out-of-Bounds Reads in Frame Processing
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages wi…
CVE-2026-111808High· 8.6Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 throug…
CVE-2026-56386High· 7.5Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-len…
CVE-2026-74755NoneApache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::a…
CVE-2026-111075High· 8.7JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unau…
CVE-2026-92853High· 8.7Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned len…
CVE-2026-98816Medium· 4.1kernel: bpf: Fix overflow of jump offset in constant blinding (CVE-2026-98816)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. An integer overflow occurs in the constant blinding mechanism when calculating backward jump offsets during BPF program hardening. A local attacker capable of l…
CVE-2026-98550High· 7.5kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (CVE-2026-98550)
A flaw was found in the TIPC (Transparent Inter-Process Communication) subsystem of the Linux kernel. This flaw allows an attacker to cause a Denial of Service (DoS) by sending unexpected or duplicate group acknowledgment messages. Due to …
CVE-2026-98573High· 7.5kernel: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (CVE-2026-98573)
A flaw was found in the Linux kernel. An integer underflow in the networking subsystem allows an attacker to trigger an out-of-bounds memory copy by sending specially crafted Internet Protocol version 6 (IPv6) packets with extension header…
CVE-2026-98591Medium· 6.7kernel: bpf: Fix bounds check for skb-backed dynptrs (CVE-2026-98591)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. An integer underflow in the bounds-checking logic for network packet buffer pointers allows validation checks to pass incorrectly. A local user capable of runni…
CVE-2026-112010Medium· 5.5smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp
smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via …
CVE-2026-111881High· 7.6PoCFreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-…
CVE-2026-49868Critical· 9.8RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation bef…
CVE-2026-48503High· 7.5PoClibIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-o…
CVE-2026-73252High· 7.5PoCMongoose is an embedded web server and network library
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no…
CVE-2026-86566Medium· 6.5A flaw was found in DPDK lib/vhost
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
CVE-2026-106464High· 8.7`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses succ…
CVE-2026-75083Medium· 5.9The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio.…
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio.…
CVE-2026-101980Critical· 9.8An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
CVE-2026-101968Medium· 5.4An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory discl…
An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory discl…
CVE-2026-101938Medium· 6.5An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an IC…
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an IC…
CVE-2026-110714Medium· 6.5PoClibsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned…
CVE-2026-50216Medium· 5.3An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a speci…
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a speci…
CVE-2026-88964High· 7.1An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
CVE-2026-97746High· 8.8Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97739High· 8.8Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97004High· 8.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-96925Medium· 5.5Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-96844High· 8.0Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.
Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.