Common Weakness Enumeration
CWE-190
AllowedInteger Overflow or Wraparound
Abstraction: Base · Status: Stable
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
1470 vulnerabilities reference this CWE, most recent first.
CVE-2026-125222 (GCVE-0-2026-125222)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 19:11
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Heap Buffer Overflow via hap_parse_frame_header()
Summary
FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code.
Severity
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/62c308e04… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:11:35.913Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/62c308e0416bb701447817fe6f0bff074d206215"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hapdec.c#L215"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Heap Buffer Overflow via hap_parse_frame_header()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hap-parse-frame-header"
}
],
"title": "FFmpeg through 9.0.2 Heap Buffer Overflow via hap_parse_frame_header()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125222",
"datePublished": "2026-11-09T19:11:35.913Z",
"dateReserved": "2026-11-09T18:15:19.944Z",
"dateUpdated": "2026-11-09T19:11:35.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125100 (GCVE-0-2026-125100)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:10 – Updated: 2026-11-09 19:10
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count
Summary
FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data.
Severity
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/commit/c05d46ea2… | patch |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Niedermayer"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder\u0027s decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:10:55.630Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/FFmpeg/FFmpeg/commit/c05d46ea2919da83233bf4216d3f58428bb54c59"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exr.c#L2219"
},
{
"tags": [
"product"
],
"url": "https://github.com/FFmpeg/FFmpeg"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-integer-overflow-in-openexr-decoder-tile-count"
}
],
"title": "FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125100",
"datePublished": "2026-11-09T19:10:55.630Z",
"dateReserved": "2026-11-09T17:44:24.931Z",
"dateUpdated": "2026-11-09T19:10:55.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124001 (GCVE-0-2026-124001)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:45 – Updated: 2026-11-09 18:45 X_Open Source
VLAI
EPSS
VEX
Title
ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR
Summary
NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.
Severity
8.1 (High)
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nasa-jpl/ION-DTN/security/advi… | vendor-advisory |
| https://github.com/nasa-jpl/ION-DTN/releases/tag/… | release-notespatch |
| https://www.vulncheck.com/advisories/ion-dtn-1b-i… | third-party-advisory |
Impacted products
Date Public
2026-11-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/nasa-jpl/ION-DTN",
"product": "ION-DTN",
"repo": "https://github.com/nasa-jpl/ION-DTN",
"vendor": "nasa-jpl",
"versions": [
{
"lessThanOrEqual": "4.2.0",
"status": "affected",
"version": "2.2.1b",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.2.1-a.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SecMate (secmate.dev)"
}
],
"datePublic": "2026-11-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API\u0027s unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:45:25.184Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rcqq-5qmv-7fxp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-rcqq-5qmv-7fxp"
},
{
"name": "Fixed Release Tag",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2"
},
{
"name": "VulnCheck Advisory: ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ion-dtn-1b-integer-overflow-heap-corruption-via-dgr"
}
],
"tags": [
"x_open-source"
],
"title": "ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124001",
"datePublished": "2026-11-09T18:45:25.184Z",
"dateReserved": "2026-11-06T18:38:38.543Z",
"dateUpdated": "2026-11-09T18:45:25.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122130 (GCVE-0-2026-122130)
Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:39
VLAI
EPSS
VEX
Title
CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
Summary
CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 19:37 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/CESNET/ipfixcol2/commit/ad206f… | patch |
| https://github.com/CESNET/ipfixcol2 | product |
| https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0 | release-notes |
| https://github.com/CESNET/ipfixcol2/blob/v2.8.0/s… | technical-description |
| https://www.vulncheck.com/advisories/cesnet-ipfix… | third-party-advisory |
Impacted products
Date Public
2026-10-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122130",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T19:37:16.685325Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:39:01.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ipfixcol2",
"vendor": "CESNET",
"versions": [
{
"lessThan": "2.9.0",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deus Rex"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michal Sedlak"
}
],
"datePublic": "2026-10-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:36:50.335Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/CESNET/ipfixcol2/commit/ad206f6217257b06b139f1b2bce50d52f5bc6acb"
},
{
"tags": [
"product"
],
"url": "https://github.com/CESNET/ipfixcol2"
},
{
"name": "ipfixcol2 v2.9.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/output/forwarder/src/Message.cpp#L134-L156"
},
{
"name": "VulnCheck Advisory: CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.3.0-before-2.9.0-buffer-overflow-via-forwarder-output-plugin"
}
],
"title": "CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122130",
"datePublished": "2026-11-04T20:36:50.335Z",
"dateReserved": "2026-11-04T18:13:10.475Z",
"dateUpdated": "2026-11-05T19:39:01.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121382 (GCVE-0-2026-121382)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:45 – Updated: 2026-11-03 19:37
VLAI
EPSS
VEX
Title
Netcore NBR100V2 auto_ac msg_aes_dec integer overflow
Summary
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:36 UTC
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430256 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430256/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121382 | third-party-advisory |
| https://vuldb.com/submit/1018496 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:36:53.896270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:37:03.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:netcore:nbr100v2:*:*:*:*:*:*:*:*"
],
"product": "NBR100V2",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.3.240614.030928"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xuanming (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-189",
"description": "Numeric Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:45:19.264Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430256 | Netcore NBR100V2 auto_ac msg_aes_dec integer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430256"
},
{
"name": "VDB-430256 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430256/cti"
},
{
"name": "CVE-2026-121382 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121382"
},
{
"name": "Submit #1018496 | Netcore NBR100V2 1.3.240614.030928 denial of service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018496"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T13:24:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Netcore NBR100V2 auto_ac msg_aes_dec integer overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121382",
"datePublished": "2026-11-03T18:45:19.264Z",
"dateReserved": "2026-11-03T12:18:07.668Z",
"dateUpdated": "2026-11-03T19:37:03.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121259 (GCVE-0-2026-121259)
Vulnerability from cvelistv5 – Published: 2026-11-03 16:30 – Updated: 2026-11-07 03:15
VLAI
EPSS
VEX
Title
Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator
Summary
A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:15 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
redhat
CNA
References
4 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-121259 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2565686 | issue-trackingx_refsource_REDHAT |
| https://gstreamer.freedesktop.org/releases/1.28/ | |
| https://gstreamer.freedesktop.org/security/sa-202… |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
Date Public
2026-04-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:15:18.151065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:15:26.660Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:03:12.427Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-121259"
},
{
"name": "RHBZ#2565686",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565686"
},
{
"url": "https://gstreamer.freedesktop.org/releases/1.28/"
},
{
"url": "https://gstreamer.freedesktop.org/security/sa-2026-0015.html"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-07T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-07T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator",
"workarounds": [
{
"lang": "en",
"value": "Applications that do not require JPEG 2000 decimation can avoid using the jp2kdecimator element and reject untrusted JPEG 2000 media before it reaches a pipeline that uses this element."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-121259",
"datePublished": "2026-11-03T16:30:06.665Z",
"dateReserved": "2026-11-03T10:39:56.737Z",
"dateUpdated": "2026-11-07T03:15:26.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120954 (GCVE-0-2026-120954)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:45 – Updated: 2026-11-03 19:42
VLAI
EPSS
VEX
Title
Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
Summary
A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:42 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
mongodb
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120954",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:42:04.160779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:42:13.241Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "C Driver",
"vendor": "MongoDB",
"versions": [
{
"lessThanOrEqual": "2.5.7",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A weakness in the BSON library\u0027s handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed."
}
],
"value": "A weakness in the BSON library\u0027s handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:45:40.025Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/CDRIVER-6420"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-120954",
"datePublished": "2026-11-03T18:45:40.025Z",
"dateReserved": "2026-11-03T03:14:08.527Z",
"dateUpdated": "2026-11-03T19:42:13.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120439 (GCVE-0-2026-120439)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-06 19:30
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
Summary
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:30 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/e93c… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120439",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:30:12.358583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:30:29.306Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:01.345Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9wv5-5cgr-grj6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L60032"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-typedarray-prototype-sort"
}
],
"title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120439",
"datePublished": "2026-11-02T14:29:01.345Z",
"dateReserved": "2026-11-02T12:42:15.449Z",
"dateUpdated": "2026-11-06T19:30:29.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120438 (GCVE-0-2026-120438)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-05 21:38
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration
Summary
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:37 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/2522… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120438",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:37:52.469353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:38:15.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:00.633Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jp52-chwg-2p9p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration"
}
],
"title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120438",
"datePublished": "2026-11-02T14:29:00.633Z",
"dateReserved": "2026-11-02T12:42:15.054Z",
"dateUpdated": "2026-11-05T21:38:15.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120436 (GCVE-0-2026-120436)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:28 – Updated: 2026-11-02 17:34
VLAI
EPSS
VEX
Title
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm
Summary
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:10 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/netpbm/code/5324/ | patch |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/535… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/535… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/537… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/532… | technical-description |
| https://www.vulncheck.com/advisories/netpbm-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:10:22.514852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:34:08.399Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Netpbm",
"vendor": "Netpbm",
"versions": [
{
"lessThan": "10.86.51",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.02.30",
"status": "affected",
"version": "11.0",
"versionType": "custom"
},
{
"lessThan": "11.15.08",
"status": "affected",
"version": "11.03",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.86.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.02.30",
"versionStartIncluding": "11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.15.08",
"versionStartIncluding": "11.03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bryan Henderson"
}
],
"datePublic": "2026-09-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:28:59.204Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sourceforge.net/p/netpbm/code/5324/"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY"
},
{
"tags": [
"technical-description"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5323/trunk/converter/other/jbig/jbigtopnm.c"
},
{
"name": "VulnCheck Advisory: Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-via-jbigtopnm"
}
],
"title": "Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120436",
"datePublished": "2026-11-02T14:28:59.204Z",
"dateReserved": "2026-11-02T12:42:14.231Z",
"dateUpdated": "2026-11-02T17:34:08.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Mitigation MIT-3
Requirements
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- If possible, choose a language or compiler that performs automatic bounds checking.
Mitigation MIT-4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Mitigation MIT-8
Implementation
Strategy: Input Validation
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Mitigation MIT-36
Implementation
- Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
- Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
Mitigation MIT-15
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-26
Implementation
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.