CWE-191
CVEs classified under CWE-191, newest first.
221 CVEsRSS
CVE-2026-106464High· 8.7`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses succ…
CVE-2026-75083Medium· 5.9The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio.…
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio.…
CVE-2026-101980Critical· 9.8An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
CVE-2026-101968Medium· 5.4An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory discl…
An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory discl…
CVE-2026-101938Medium· 6.5An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an IC…
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an IC…
CVE-2026-110714Medium· 6.5PoClibsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned…
CVE-2026-50216Medium· 5.3An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a speci…
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a speci…
CVE-2026-88964High· 7.1An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
CVE-2026-97746High· 8.8Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97739High· 8.8Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97004High· 8.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-96925Medium· 5.5Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-96844High· 8.0Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.
Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.
CVE-2026-88195Medium· 6.5Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-88143Medium· 6.7Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
CVE-2026-85806Critical· 9.8Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVE-2026-85339High· 8.8Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVE-2026-83869Critical· 9.8Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-83855High· 7.5Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.
Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.
CVE-2026-83838High· 8.0Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.
Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.
CVE-2026-83836High· 7.8Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.
CVE-2026-83676High· 7.0Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.
Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-83578Critical· 9.8Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
CVE-2026-70064High· 7.8Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.
Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVE-2026-102192High· 7.5Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
CVE-2026-100222Critical· 9.8Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVE-2026-88833Medium· 6.5A flaw was found in BusyBox's udhcpc DHCP client
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads t…
CVE-2026-65200Low· 3.5The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supp…
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supp…
CVE-2026-102073High· 8.2A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (…
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (…
CVE-2026-58249High· 7.5PoCSAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handl…