Wireshark LBMC reassembly bug allows remote code execution
Only Wireshark installs with LBMC fragment reassembly enabled are affected; ZDI rates it CVSS 7.5.
Stories per day · 30 days
2 RSS
Relatedgitlab14rce9remote-code-execution8ci-cd4zdi4cve-2026-972293denial-of-service3privilege-escalation3self-managed3adobe2heap2kernel2kev2ldap2libc2musl2onigmo2openbsd2
53 stories, newest first · one card per story
Stories tagged #integer-overflow
X.Org Server XkbResizeKeySyms overflow allows local privilege escalation
ZDI rates CVE-2026-50258 at 7.8 and says low-privileged code is required first.
Apache Struts2 Core Integer Overflow
Apache Struts2 Core up to version 7.4.0 fails to prevent integer overflows that cause wrap-arounds on downstream casting to types smaller than BigInteger.
TeamViewer clients before 15.83 let malicious hosts run code on viewers
CVE-2026-111585 is an integer overflow scored 8.8 and fixed in 15.83; TeamViewer reports no known exploitation.
1
CISA adds exploited GitLab integer overflow CVE-2026-97229 to KEV
FCEB agencies must prioritize the GitLab flaw on exposed assets and check for compromise before patching.
CISA KEV lists GitLab unauthenticated RCE CVE-2026-97229
A crafted regular expression in CI/CD configuration can run arbitrary code; the federal due date is November 1, 2026.
Kafka Streams can hang on punctuation integer overflow (CVE-2026-111496)
A record timestamp near Long.MAX_VALUE can overflow the next punctuation time and stall a StreamThread.
Godot 4.0.0–4.7.2 remote crash via spawn-packet overflow
A bounds check in SceneReplicationInterface::on_spawn_receive fails on sync_len; no patch version is named.
GitLab patches max-severity regex compiler RCE (CVE-2026-110264)
Unauthenticated users can run code via integer overflow when a crafted regular expression is compiled.
EPICS Base 7.0.10 and earlier: network flaws up to CVSS 9.8
Update to EPICS Base 7.0.11; the worst flaw can corrupt memory and may allow remote code execution.
GitLab patches unauthenticated code execution bug CVE-2026-110264
The integer overflow hits GitLab CE/EE back to 7.0; fixes include 19.5.1 and backports through 18.11.13.
GitLab patches unauthenticated RCE in CE and EE (CVE-2026-110264)
The integer overflow reaches GitLab 7.0 from June 2014; no in-the-wild exploitation is indicated yet.
2
GitLab patches max-severity regex compiler RCE (CVE-2026-110264)
An unauthenticated integer overflow can run arbitrary code; GitLab.com is already on the patched release.
14
GitLab patches unauthenticated regex RCE rated CVSS 10.0
CVE-2026-110264 reaches back to GitLab 7.0; self-managed admins must upgrade, and in-the-wild use is not confirmed.
2
GitLab fixes unauthenticated RCE in CE and EE (CVE-2026-110264)
The integer-overflow bug scores CVSS 10.0, is fixed in seven releases, and has no confirmed attacks or public exploit.
3
GitLab RCE flaw scores CVSS 10 (CVE-2026-110264)
Community and Enterprise builds from 7.0 before the listed 18.x and 19.x patches need urgent updates.
GitLab fixes unauthenticated RCE back to version 7.0 (CVE-2026-110264)
The CVSS 10.0 Onigmo overflow has no known attacks and no workaround; only self-managed installs must upgrade.
musl libc regcomp integer overflows may cause heap out-of-bounds writes
CVE-2026-107891 covers multiple overflows that can yield wrong allocation sizes; no fix is stated.
musl libc regcomp overflows can cause heap writes (CVE-2026-107891)
Overflow conditions depend on the size and complexity of the regular expression passed to regcomp.
OpenBSD 7.9 local root exploit chains old BSD bug with kernel flaw
Calif’s public chain bypasses KARL, SMAP, and SMEP; OpenBSD patched both issues in September via syspatch.
2
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
Calif details a patched OpenBSD local-root bug tracing to a 37-year-old shared-memory counter.
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Rapid7 shows a reliable RCE proof of concept for GitLab's CVSS 10 regex flaw CVE-2026-97229.
9
ZDI-26-781: LibreOffice EMF+ Brush Integer Overflow Remote Code Execution Vulnerability
ZDI disclosed a LibreOffice EMF+ integer overflow that can enable remote code execution.
PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229)
A public PoC shows critical GitLab CVE-2026-97229 can run commands after a project push.
9