Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
17 matching advisories · 17 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium5.5
CVE-2026-124743

Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober

A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Enterprise Linux 6 / Red Hat · Red Hat Hardened Images
medium5.5
CVE-2026-124742

Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value

A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Hardened Images / Red Hat · Red Hat Enterprise Linux 6
medium5.5
CVE-2026-114373

Photoshop Desktop | Divide By Zero (CWE-369)

Photoshop Desktop is affected by a Divide By Zero vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Adobe · Photoshop / Adobe · Photoshop
medium6.5
CVE-2026-109802

Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

SAP_SE · SAP NetWeaver Application Server for ABAP
medium5.7
CVE-2026-125258

FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c

FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

FFmpeg · FFmpeg
medium6.8
CVE-2026-125254

FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ff_vvc_mv_scale(), crashing the decoding process.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

FFmpeg · FFmpeg
medium6.8
CVE-2026-125232

FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

FFmpeg · FFmpeg
medium6.8
CVE-2026-125185

FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points

FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generate_scaling() to divide by zero and crash the decoder.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

FFmpeg · FFmpeg
high7.1
CVE-2026-107359

Malformed Wi-Fi Beacon Causes Crash on WF200

Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Silicon Labs · WF200 FW
medium6.8
CVE-2026-122330

Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Blosc · c-blosc2
medium5.3
CVE-2026-121410

FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2

FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

FreeRDP · FreeRDP
medium5.5
CVE-2026-65160

NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero.

NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

NVIDIA · CUDA Toolkit / NVIDIA · NVJPEG
medium4.8
CVE-2026-59959

SAIL: WebP decoder division by zero through malformed animated canvas metadata

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or ANMF frame metadata. In sail_codec_load_init_v8_webp() in src/sail-codecs/webp/webp.c, WebPDemuxGetI with WEBP_FF_CANVAS_WIDTH can return a zero image_local->width, which is then used as a divisor when calculating bytes_per_pixel from the image row size. The division happens before frame decoding and before generic image skeleton validation in src/sail/sail_advanced.c, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

HappySeaFox · sail
medium6.8
CVE-2026-110605

libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

tomolt · libschrift
medium6.3
CVE-2026-93589

ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

ImageMagick · ImageMagick / ImageMagick · ImageMagick
medium4.6
CVE-2026-7007

Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

zephyrproject · zephyr