Total
3569 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-27427 | 1 Riot-os | 1 Riot | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. | |||||
| CVE-2021-27425 | 1 Cesanta | 1 Mongoose Os | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. | |||||
| CVE-2021-27421 | 1 Nxp | 1 Mcuxpresso Software Development Kit | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc. | |||||
| CVE-2021-27419 | 1 Uclibc-ng Project | 1 Uclibc-ng | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. | |||||
| CVE-2021-27417 | 1 Ecoscentric | 1 Ecospro | 2026-06-17 | 7.5 HIGH | 4.6 MEDIUM |
| eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow. | |||||
| CVE-2021-27411 | 1 Silabs | 1 Micrium Os | 2026-06-17 | 6.4 MEDIUM | 6.5 MEDIUM |
| Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones. | |||||
| CVE-2021-27259 | 1 Parallels | 1 Parallels Desktop | 2026-06-17 | 4.4 MEDIUM | 7.8 HIGH |
| This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12021. | |||||
| CVE-2021-27243 | 1 Parallels | 1 Parallels Desktop | 2026-06-17 | 4.6 MEDIUM | 8.8 HIGH |
| This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-11924. | |||||
| CVE-2021-26945 | 1 Openexr | 1 Openexr | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. | |||||
| CVE-2021-26825 | 1 Godotengine | 1 Godot Engine | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size; The bug leads to Dynamic stack buffer overflow. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash. | |||||
| CVE-2021-26706 | 1 Micrium | 1 Uc\/lib | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker. | |||||
| CVE-2021-26615 | 2 Bandisoft, Linux | 2 Ark Library, Linux Kernel | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow. | |||||
| CVE-2021-26461 | 1 Apache | 1 Nuttx | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. | |||||
| CVE-2021-26380 | 2026-06-17 | N/A | N/A | ||
| A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity. | |||||
| CVE-2021-26377 | 2026-06-17 | N/A | 4.1 MEDIUM | ||
| Insufficient parameter validation while allocating process space in the Trusted OS (TOS) may allow for a malicious userspace process to trigger an integer overflow, leading to a potential denial of service. | |||||
| CVE-2021-26346 | 1 Amd | 208 Ryzen 3 3100, Ryzen 3 3100 Firmware, Ryzen 3 3200g and 205 more | 2026-06-17 | N/A | 5.5 MEDIUM |
| Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service. | |||||
| CVE-2021-26329 | 1 Amd | 114 Epyc 7232p, Epyc 7232p Firmware, Epyc 7251 and 111 more | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources. | |||||
| CVE-2021-26260 | 3 Debian, Fedoraproject, Openexr | 3 Debian Linux, Fedora, Openexr | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215. | |||||
| CVE-2021-26109 | 1 Fortinet | 1 Fortios | 2026-06-17 | 7.5 HIGH | 8.1 HIGH |
| An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution. | |||||
| CVE-2021-25803 | 1 Videolan | 1 Vlc Media Player | 2026-06-17 | 5.8 MEDIUM | 7.1 HIGH |
| A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file. | |||||