CVE-2026-16416
Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via
CVSS
9.3
Crítico
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 21 jul 2026 · Última mod.: 24 oct 2026 · CWE-190
0.1%EPSS · 30 días0.1%
2026-09-282026-10-25
Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1168406.1 MED—
———llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.5hCVE-2026-1168296.6 MED—
———llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.5hCVE-2026-1167343.7 BAJ—
———flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.8hCVE-2026-1167247.8 ALT—
———FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.8hCVE-2026-116591——
———compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.8hCVE-2026-647598.8 ALT—
———An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution.2h