CWE-195

W bibliotece libesl projektu FreeSWITCH funkcja esl_recv_event() nie weryfikuje wartości Content-Length przed przekazaniem jej do malloc(), co umożliwia zdalne uszkodzenie sterty lub awarię procesu. Podatność jest krytyczna, ponieważ może być wyzyskana przed uwierzytelnieniem przez dowolnego złośliwego lub pośredniczącego peera ESL.

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: llama_vocab::impl::token_to_piece() casts a very large size_t token length into an int32_t, causing the length check (if (length < (int32_t)size)) to be bypassed. As a result, memcpy is still called with that oversized size, letting a malicious model overwrite memory beyond the intended buffer. This can lead to arbitrary memory corruption and potential code execution. This issue has been patched in version b5662.

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721.

illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.

drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.

W serwerze Coturn (TURN/STUN) w wersjach od 4.5.2 do 4.14.0 nieuwierzytelniony atakujący może wysłać pojedyncze żądanie HTTP GET i w odpowiedzi 301 otrzymać do ~870 bajtów surowej pamięci heap procesu. Wyciek może ujawniać dane innych klientów, takie jak poświadczenia TURN, tokeny OAuth lub treści przekazywanych pakietów.

An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.

An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Memory corruption while parsing the ADSP response command.

Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509() to return -1 and be misused as a malloc() size parameter.

A Signed to Unsigned Conversion Error vulnerability in the Layer 2 Control Protocol daemon (l2cpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated adjacent attacker sending a specifically malformed LLDP TLV to cause the l2cpd process to crash and restart, causing a Denial of Service (DoS).  Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. When an LLDP telemetry subscription is active, receipt of a specifically malformed LLDP TLV causes the l2cpd process to crash and restart. This issue affects: Junos OS: * All versions before 21.2R3-S9,  * from 21.4 before 21.4R3-S10,  * from 22.2 before 22.2R3-S6,  * from 22.4 before 22.4R3-S6,  * from 23.2 before 23.2R2-S3,  * from 23.4 before 23.4R2-S4,  * from 24.2 before 24.2R2;  Junos OS Evolved:  * All versions before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO,  * from 22.4-EVO before 22.4R3-S6-EVO,  * from 23.2-EVO before 23.2R2-S3-EVO,  * from 23.4-EVO before 23.4R2-S4-EVO,  * from 24.2-EVO before 24.2R2-EVO.

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.

There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI file.  This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.

pupnp to SDK do tworzenia aplikacji urządzeń UPnP i control point. Przed wersją 1.18.5 pupnp był podatny na SSRF port confusion z powodu obcinania portu przez cast atoi() w parse_uri(). Problem został naprawiony w wersji 1.18.5.

Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.

OpenEXR to specyfikacja i referencyjna implementacja formatu pliku EXR, formatu przechowywania obrazów dla branży filmowej. W wersjach 3.3.0 do 3.3.6 i 3.4.0 do 3.4.4 występuje heap-buffer-overflow (OOB read) w funkcji `istream_nonparallel_read` w pliku `ImfContextInit.cpp` podczas przetwarzania zniekształconego pliku EXR przez memory-mapped `IStream`. Odejmowanie liczb całkowitych ze znakiem daje ujemną wartość, która jest niejawnie konwertowana na `size_t`, co powoduje przesłanie ogromnej długości do `memcpy`. Wersje 3.3.7 i 3.4.5 zawierają patch.

W NLnet Labs Unbound w wersjach od 1.22.0 do 1.25.1 włącznie, zdalny niezauthentykowany klient może wyzwolić asercję libngtcp2 (jeśli kompilacja zawiera asercje) i zakończyć cały proces Unbound za pomocą jednego połączenia DNS-over-QUIC (DoQ) i jednego normalnego zapytania DNS. Problem wynika z błędnej wartości błędu przekazywanej do libngtcp2. Gdy `ngtcp2_conn_writev_stream()` zwraca `NGTCP2_ERR_STREAM_DATA_BLOCKED`, Unbound dalej wywołuje `ngtcp2_ccerr_set_application_error()` z wartością błędu `-1`. Literał `int` `-1` jest niejawnie konwertowany na parametr `uint64_t error_code` funkcji jako `0xFFFFFFFFFFFFFFFF`. Następujące `ngtcp2_conn_write_connection_close()` serializuje tę wartość jako QUIC varint; ponieważ `2^64-1` przekracza limit

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.