CWE-681.

FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

• signalwire freeswitch
• Memory corruption
• CWE-681

Incorrect numeric conversion in Samsung Semiconductor Exynos 1480 and others

• Samsung Semiconductor Exynos 1480
• Samsung Semiconductor Exynos 2400
• CWE-681

Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions

• tesseract
• Memory corruption
• CWE-681

Botan: Integer overflow when reporting block size in FFI can cause memory corruption

• randombit botan
• Memory corruption
• CWE-681

BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards

• MongoDB C# Driver
• CWE-681

Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound

• vyper
• CWE-681

IBM MQ Denial of Service

• IBM MQ Operator
• IBM MQ Advanced container images
• CWE-681

Windows TCP/IP Local Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-681

Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

• MongoDB PHP Driver
• CWE-681

Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

• Memory corruption
• CWE-681

>=2.1.0, <2.11.1-0.20260805032953-db93f8d89de7 · fixed in 2.11.1-0.20260805032953-db93f8d89de7

Incorrect numeric conversion in NVIDIA Virtual GPU Manager

• NVIDIA Virtual GPU Manager
• CWE-681

Incorrect numeric conversion in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• CWE-681

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType).

• CWE-681

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function.

• CWE-681

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization.

• CWE-681

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands.

• CWE-681

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c.

• CWE-681

RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

• CWE-681

<1.13.0 · fixed in 1.13.0

Microsoft JScript Remote Code Execution Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-681

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

• MongoDB C Driver
• CWE-681

BSON element injection via NUL-embedded document keys in builder append

• MongoDB C++ Driver
• CWE-681

Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser

• MongoDB C++ Driver
• CWE-681

libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation

• libjxl
• CWE-681

su-exec through 0.3 Privilege Escalation via Numeric User ID

• ncopa su-exec
• CWE-681

netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

• Memory corruption
• CWE-248

<0.0.23.Final · fixed in 0.0.23.Final

FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer

• FFmpeg
• CWE-681

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 10
• CWE-681

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-681

Incorrect numeric conversion in Samsung Mobile Devices

• Samsung Mobile Devices
• CWE-681

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

• Memory corruption
• CWE-681

<14.15.0 · fixed in 14.15.0

GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

• allinurl goaccess
• Denial of service
• CWE-681

Microsoft PowerPoint Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Memory corruption
• CWE-681

NTFS Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-126
• CWE-681

Multiple vulnerabilities in the sound(4) mmap path

• FreeBSD
• Memory corruption
• CWE-681

iommu/amd: Fix clone_alias() to use the original device's devid

• Linux kernel
• CWE-681

Incorrect Conversion between Numeric Types in NI grpc-device due to missing range checks in CodeGen

• NI grpc-device
• NI InstrumentStudio
• CWE-681

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

• Information disclosure
• CWE-681

>=0.5.5, <0.24.0 · fixed in 0.24.0

Incorrect numeric conversion in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• CWE-681

iskorotkov/avro: Integer Overflow in Decoder

• Memory corruption
• CWE-681

<2.33.0 · fixed in 2.33.0

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Memory corruption
• CWE-681

Host data leakage with 64-bit tables and Winch

• CWE-681

>=0.0.0-0, <36.0.7 || >=37.0.0, <42.0.2 || >=43.0.0, <43.0.1 · fixed in 36.0.7, 42.0.2, 43.0.1

Incorrect numeric conversion in NVIDIA Triton Inference Server

• NVIDIA Triton Inference Server
• CWE-681

CVE-2026-4931

• Marginal Smart Contract
• CWE-681

leancrypto: Integer truncation in X.509 name parser enables certificate identity impersonation

• smuellerDD leancrypto
• CWE-681

iccDEV: UB at IccIO.cpp

• InternationalColorConsortium iccDEV
• CWE-681

iccDEV: UB at IccUtilXml.cpp

• InternationalColorConsortium iccDEV
• CWE-681

jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

• CWE-681

<11.1.1 · fixed in 11.1.1

Soroban: Muxed address<->ScVal conversions may break after a conversion failure

• CWE-681

<26.0.0 · fixed in 26.0.0

iccDEV has SIO in parse3DTable() at iccFromCube.cpp Line 218

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-681

ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

• Memory corruption
• CWE-681

<14.10.3 · fixed in 14.10.3

iccDEV has UB runtime error in <icTagTypeSignature>

• InternationalColorConsortium iccDEV
• CWE-20
• CWE-681

A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

• Denial of service
• CWE-681

iccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cpp

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cpp

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-681

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

• CWE-197
• CWE-681

<1.5.1 · fixed in 1.5.1

CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion

• CWE-681

>=1.2.0, <1.12.4 · fixed in 1.12.4

Microsoft Word Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• CWE-681

Windows Common Log File System Driver Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• Memory corruption
• CWE-681

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

• Microsoft Windows 11 Version 24H2
• Microsoft Windows Server 2025
• CWE-681