CVE-2026-16408
Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153.
CVSS
9.8
Critical
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Jul 21, 2026 · Last modified: Jul 21, 2026 · CWE-190
Not enough EPSS history yet.
Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-163959.8 CRI—
——0Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153.28mCVE-2026-415218.2 HIG44.3%
——13xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data using the original oversized parameters leads to an out-of-bounds read. An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a denial of service (DoS) via a process crash. This issue has been fixed in version 0.10.6.1.55mCVE-2026-33328—2.1%
——1libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.3hCVE-2026-33327—3.2%
——1libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.1dCVE-2026-630916.5 MED21.5%
——6ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.1dCVE-2026-552544.8 MED8.7%
——3NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits specially crafted expressions with extremely large factorial operands, causing excessive CPU consumption or a non-terminating loop due to integer overflow in the factorial calculation logic when applications evaluate untrusted expressions. This issue is fixed in version 6.1.1.1d