Common Weakness Enumeration
CWE-191
AllowedInteger Underflow (Wrap or Wraparound)
Abstraction: Base · Status: Draft
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
804 vulnerabilities reference this CWE, most recent first.
GHSA-FRR2-5QJR-H4HW
Vulnerability from github – Published: 2026-03-23 21:30 – Updated: 2026-05-04 21:30
VLAI
Details
strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-25075"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-23T19:16:39Z",
"severity": "HIGH"
},
"details": "strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.",
"id": "GHSA-frr2-5qjr-h4hw",
"modified": "2026-05-04T21:30:23Z",
"published": "2026-03-23T21:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25075"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00016.html"
},
{
"type": "WEB",
"url": "https://www.strongswan.org/blog/2026/03/23/strongswan-6.0.5-released.html"
},
{
"type": "WEB",
"url": "https://www.strongswan.org/blog/2026/03/23/strongswan-vulnerability-(cve-2026-25075).html"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/strongswan-eap-ttls-avp-parsing-integer-underflow"
},
{
"type": "WEB",
"url": "https://y637f9qq2x.com/posts/cve-2026-25075"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FRXW-5MMH-WH9R
Vulnerability from github – Published: 2024-07-09 18:30 – Updated: 2024-07-09 18:30
VLAI
Details
Windows Workstation Service Elevation of Privilege Vulnerability
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-38050"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T17:15:33Z",
"severity": "HIGH"
},
"details": "Windows Workstation Service Elevation of Privilege Vulnerability",
"id": "GHSA-frxw-5mmh-wh9r",
"modified": "2024-07-09T18:30:51Z",
"published": "2024-07-09T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38050"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38050"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G36G-XCJC-MWVJ
Vulnerability from github – Published: 2022-04-29 02:58 – Updated: 2025-04-03 04:02
VLAI
Details
Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application crash) via a malformed IP packet.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2004-0816"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-12-23T05:00:00Z",
"severity": "MODERATE"
},
"details": "Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application crash) via a malformed IP packet.",
"id": "GHSA-g36g-xcjc-mwvj",
"modified": "2025-04-03T04:02:41Z",
"published": "2022-04-29T02:58:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0816"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17800"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/11202"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:022"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2004_37_kernel.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/11488"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G42G-9VM4-7GFJ
Vulnerability from github – Published: 2026-09-18 15:32 – Updated: 2026-09-18 15:32
VLAI
Details
rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-93599"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-18T14:19:11Z",
"severity": "HIGH"
},
"details": "rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.",
"id": "GHSA-g42g-9vm4-7gfj",
"modified": "2026-09-18T15:32:18Z",
"published": "2026-09-18T15:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93599"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G454-M7R7-F68Q
Vulnerability from github – Published: 2024-01-08 15:30 – Updated: 2024-04-09 21:31
VLAI
Details
Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the left shift operation.
Severity
7.0 (High)
{
"affected": [],
"aliases": [
"CVE-2023-39413"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-08T15:15:24Z",
"severity": "HIGH"
},
"details": "Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the left shift operation.",
"id": "GHSA-g454-m7r7-f68q",
"modified": "2024-04-09T21:31:55Z",
"published": "2024-01-08T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39413"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1824"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1824"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G49M-VV72-HPJC
Vulnerability from github – Published: 2026-02-13 06:30 – Updated: 2026-03-02 18:31
VLAI
Details
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated. The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48021"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-13T06:16:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.\nIf affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.\nThe affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier",
"id": "GHSA-g49m-vv72-hpjc",
"modified": "2026-03-02T18:31:38Z",
"published": "2026-02-13T06:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48021"
},
{
"type": "WEB",
"url": "https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G4XF-VJ7C-7443
Vulnerability from github – Published: 2024-09-18 09:30 – Updated: 2026-10-03 12:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Ensure array index tg_inst won't be -1
[WHY & HOW] tg_inst will be a negative if timing_generator_count equals 0, which should be checked before used.
This fixes 2 OVERRUN issues reported by Coverity.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-46730"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T07:15:04Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Ensure array index tg_inst won\u0027t be -1\n\n[WHY \u0026 HOW]\ntg_inst will be a negative if timing_generator_count equals 0, which\nshould be checked before used.\n\nThis fixes 2 OVERRUN issues reported by Coverity.",
"id": "GHSA-g4xf-vj7c-7443",
"modified": "2026-10-03T12:31:00Z",
"published": "2024-09-18T09:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46730"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/15403445b873a4ce45b2d4ecfb5928a025297282"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a64284b9e1999ad5580debced4bc6d6adb28aad4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G562-3MH5-27V6
Vulnerability from github – Published: 2026-04-23 18:33 – Updated: 2026-06-30 03:36
VLAI
Details
A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-33999"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-23T16:16:24Z",
"severity": "HIGH"
},
"details": "A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.",
"id": "GHSA-g562-3mh5-27v6",
"modified": "2026-06-30T03:36:22Z",
"published": "2026-04-23T18:33:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33999"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10739"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20576"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20590"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21699"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21712"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21715"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21716"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21718"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21741"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21742"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22424"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22456"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23254"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23255"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23496"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24341"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-33999"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451106"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33999.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11352"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11369"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11388"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11656"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11692"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13414"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19125"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19342"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19343"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19344"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20547"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20555"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20557"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20558"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20560"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20561"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20562"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20563"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20575"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G5RF-95RX-Q3M2
Vulnerability from github – Published: 2022-05-17 03:45 – Updated: 2022-05-17 03:45
VLAI
Details
Integer overflow in drivers/char/diag/diag_dci.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges or obtain sensitive information via a crafted application, aka Android internal bug 28769912 and Qualcomm internal bug CR565160.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2014-9883"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-08-06T10:59:00Z",
"severity": "HIGH"
},
"details": "Integer overflow in drivers/char/diag/diag_dci.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges or obtain sensitive information via a crafted application, aka Android internal bug 28769912 and Qualcomm internal bug CR565160.",
"id": "GHSA-g5rf-95rx-q3m2",
"modified": "2022-05-17T03:45:21Z",
"published": "2022-05-17T03:45:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9883"
},
{
"type": "WEB",
"url": "https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=cbf79a67348e48557c0d0bb9bc58391b3f84bc46"
},
{
"type": "WEB",
"url": "http://source.android.com/security/bulletin/2016-08-01.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92219"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G663-R6HR-QMC2
Vulnerability from github – Published: 2026-08-13 00:31 – Updated: 2026-08-13 00:31
VLAI
Details
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-18727"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T22:17:14Z",
"severity": "MODERATE"
},
"details": "A flaw was found in open-iscsi\u0027s iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.",
"id": "GHSA-g663-r6hr-qmc2",
"modified": "2026-08-13T00:31:25Z",
"published": "2026-08-13T00:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18727"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-18727"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462956"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.