CVE-2026-63209

The record

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Affected packages

Related vulnerabilities

• CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
• CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190
• CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
• CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
• CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add()… CWE-190
• CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. CWE-190
• CVE-2026-102620 A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. CWE-190
• CVE-2026-102633 libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in… CWE-190