By weakness (CWE)

CWE-369: related vulnerabilities

CVEs classified under CWE-369. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

8 published vulnerabilities

• CVE-2026-37232HIGH 8.6

  OpenAirInterface5G version 2.4.0 contains a vulnerability in how it calculates radio resource block (PRB) utilization metrics for 5G base stations. An attacker on the network can repeatedly request performance monitoring data via the FlexRIC interface, causing the base station software to crash when certain metric calculations divide by zero. The crash takes down the entire 5G cell, disconnecting all users. This requires no authentication and can be triggered remotely.

• CVE-2025-55642MEDIUM 6.5

  GPAC MP4Box version 2.4 contains a flaw that can cause the application to crash when processing certain MP4 files. The vulnerability exists in code responsible for handling audio and video data during file writing operations. An attacker could craft a malicious MP4 file that, when opened in MP4Box, triggers a mathematical error leading to a denial of service. No data theft or file corruption occurs, but the crash prevents legitimate work with video files.

• CVE-2026-47152MEDIUM 6.5

  EmberZNet v9.0.2 and earlier contain a denial-of-service vulnerability triggered by a specially crafted Level Control Move command. An attacker with network access and credentials to join the network can send this malformed command to crash the EmberZNet process, disrupting device functionality. The vulnerability only affects devices that implement the Level Control cluster, a component used for controlling brightness, speed, or similar dimming/ramping functions in Zigbee networks.

• CVE-2026-47153MEDIUM 6.5

  A flaw in Silicon Labs EmberZNet v9.0.2 and earlier allows a network-joined device to crash the software through a specially crafted Level Control Step command. The vulnerability stems from a divide-by-zero error that terminates the process. Because the attacker must already be part of the network and the target device must support Level Control (a lighting/dimming feature in Zigbee), the exposure is narrower than an unauthenticated internet attack, but still represents a denial-of-service risk in IoT and smart-home deployments.

• CVE-2025-70100MEDIUM 5.5

  CVE-2025-70100 is a denial-of-service vulnerability in lwext4, a lightweight ext4 filesystem library. An attacker can craft a malicious ext4 filesystem image containing a zero logical block size that crashes any application using lwext4 to mount or process the image. The library fails to validate the block size parameter before performing arithmetic operations, leading to a divide-by-zero condition. While this vulnerability cannot be exploited for data theft or system compromise, it can disrupt services that depend on lwext4 for filesystem operations, such as embedded systems, recovery tools, or specialized storage applications.

• CVE-2026-46161MEDIUM 5.5

  A divide-by-zero vulnerability exists in the Linux kernel's RAID10 disk management code. When a user configures RAID10 with a "far_copies" value of zero, the kernel crashes instead of rejecting the invalid configuration. This requires local access and root-level privileges to trigger, making it a local denial-of-service risk rather than a remote compromise threat.

• CVE-2026-46184MEDIUM 5.5

  A USB audio device driver in the Linux kernel can crash if a malformed device provides zero audio channels. The driver fails to validate a critical USB descriptor field before using it in calculations, leading to a division-by-zero error when the device is connected. An attacker with physical access to plug in a crafted USB device could trigger a kernel panic on vulnerable systems.

• CVE-2026-10201LOW 3.3

  CVE-2026-10201 is a divide-by-zero flaw in Assimp (Asset Importer Library), a widely-used 3D model processing library. The defect exists in the UV Channel Handler component, specifically within the FBXExporter::WriteObjects function in FBXExporter.cpp. When a user with local access supplies specially crafted input, the vulnerability triggers a division-by-zero error that crashes the application. Because this is a local-only attack requiring user-level privileges and the impact is availability-focused (denial of service via crash), the risk is classified as low. However, the fact that proof-of-concept code has been publicly released means defenders should not assume this will remain a theoretical concern.