CVE-2025-49180High· 7.8▾ TwilightA flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-49179High· 7.3A flaw was found in the X Record extension
CVE-2025-49176High· 7.3A flaw was found in the Big Requests extension
CVE-2026-43618High· 8.1Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receive…
CVE-2026-5121High· 7.5A flaw was found in libarchive
CVE-2026-53705High· 7.6A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good
CVE-2026-52722High· 7.1A signed integer overflow vulnerability was found in GStreamer's VMnc decoder