CWE-681
CVEs classified under CWE-681, newest first.
45 CVEsRSS
CVE-2026-114654Medium· 6.5BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such …
CVE-2026-98869High· 7.8kernel: bpf: Infer zext_dst based on static register liveness analysis (CVE-2026-98869)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local attacker could achieve privilege escalation by loading a specially crafted BPF program into the kernel. The vulnerability occurs because the verifier fai…
CVE-2026-114118Medium· 4.8Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive valu…
CVE-2026-12670Medium· 5.3IBM MQ Denial of Service
IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
CVE-2026-98590Medium· 6.7kernel: bpf: Fix bpf_sock context code generation (CVE-2026-98590)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. An error in context code generation incorrectly sign-extends register values when reading socket queue mappings, causing runtime register values to exceed bound…
CVE-2026-98417High· 7.5In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trim…
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trim…
CVE-2026-83872High· 7.8Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-106432Low· 3.6The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original l…
CVE-2026-107224Medium· 6.5PoCExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks an…
CVE-2026-98288Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmac_tso_xmit() stores the protocol header length returned by stmmac_tso_header_size() in a u8
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmac_tso_xmit() stores the protocol header length returned by stmmac_tso_header_size() in a u8. stmmac_tso_valid_packet…
CVE-2026-47508High· 7.8NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an incorrect conversion between numeric types
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an incorrect conversion between numeric types. A successful exploit of this vulnerability might lead to code exec…
CVE-2026-47539Medium· 6.7NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect numeric conversion
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect numeric conversion. A successful exploit of this vulnerability might lead to code execution, denial of…
CVE-2026-98049Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PRO…
In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PRO…
CVE-2026-98095Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). syzbot reported BUG() in sock_sendmsg_nosec()
In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). syzbot reported BUG() in sock_sendmsg_nosec(). [0] The problem is that tpacket_parse_header…
CVE-2026-98157Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation The poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned long, but the ta…
In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation The poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned long, but the ta…
CVE-2026-88387Medium· 5.5PoCLibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType)
LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileTyp…
CVE-2026-97421High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Several corner cases, especially important on 32 bits: - umem->iova is u64, the function a…
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Several corner cases, especially important on 32 bits: - umem->iova is u64, the function a…
CVE-2026-88367Medium· 6.5PoCNanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization
NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding …
CVE-2026-88368High· 7.5PoCNanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-sca…
CVE-2026-88366High· 7.5PoCNanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculat…
CVE-2026-88362High· 7.5PoCMuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to…
CVE-2026-77412High· 8.9RabbitMQ amqp091-go is a Go AMQP 0.9.1 client
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer.…
CVE-2026-89450High· 8.8iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spa…
CVE-2026-69438High· 8.1Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network.
Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network.
CVE-2026-84963Medium· 5.3An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation …
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation …
CVE-2026-84966Medium· 5.1An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to …
CVE-2026-84970Medium· 6.2A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that tex…
CVE-2026-82522Medium· 5.4libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can su…
CVE-2026-82457High· 7.8PoCsu-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that trun…
CVE-2026-61799Medium· 5.3netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash