Full takeover of Oracle Retail Integration Bus 16.0.3 (RIB Kernel component) is achievable by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete compromise of the RIB instance with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially low attack complexity makes it a high-priority patch target.
Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
Full takeover of Oracle Coherence is possible by remote unauthenticated attackers who reach the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the Core component of versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is achievable by an unauthenticated remote attacker over TCP against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 9.8 with high impact to confidentiality, integrity, and availability, and describes it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch item.
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via HTTP, per Oracle's July 2026 Critical Patch Update. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a maximum-severity CVSS 3.1 score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, but WebLogic's history as a repeated exploitation target makes this a high-priority patch.
Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker with only HTTP network access to fully compromise the application. Oracle rates this 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no authentication, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a top-priority patch in the July 2026 Critical Patch Update.
Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CWE-502 root cause and 9.8 CVSS score make it a high-priority patch for any service that deserializes untrusted input with the C++ implementation.
Full takeover of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 is possible when an unauthenticated remote attacker reaches the vulnerable Integration component over HTTPS. Oracle rates this 9.8 (CVSS 3.1) with high confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, privileges, or user interaction are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity unauthenticated profile makes it a priority patch in the Oracle July 2026 Critical Patch Update.
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.
Remote takeover of Oracle Data Integrator 14.1.2.0.0 (Oracle Fusion Middleware) is possible via the REST Service component, allowing an unauthenticated attacker with network access over HTTPS to fully compromise the product. Oracle rates this CVSS 9.8 with full confidentiality, integrity and availability impact and characterizes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attacker with network access via the T3 or IIOP protocols to fully compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild despite the maximal severity.
Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.
Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated attackers reach the T3 or IIOP protocols exposed by the underlying WebLogic server, per Oracle's July 2026 Critical Patch Update. The Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised (confidentiality, integrity, and availability), earning a CVSS 9.8. No public exploit has been identified at time of analysis, but the T3/IIOP attack surface has a long history of critical WebLogic deserialization exploitation.
Full takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is possible by unauthenticated remote attackers reaching the T3 or IIOP protocols. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the T3/IIOP attack surface is a historically abused deserialization vector on the underlying WebLogic stack, warranting priority patching.
Full takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker can compromise the platform over HTTP. Oracle rates this a CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by an unauthenticated remote attacker who reaches the T3 or IIOP protocol endpoints. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, carrying a maximum-severity CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the T3/IIOP attack surface is historically a high-value target in the Oracle WebLogic/Fusion stack.
Unauthorized data modification in Oracle WebLogic Server Proxy Plug-in (the proxy module for third-party web servers such as Apache/Oracle HTTP Server) lets a remote, unauthenticated attacker tamper with critical data over HTTP. Oracle's authoritative scoring rates this CVSS 3.1 7.5 with integrity-only impact (I:H, C:N, A:N), disclosed in the July 2026 Critical Patch Update and tagged as an authentication-bypass class issue. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle HTTP Server (Oracle Fusion Middleware) is possible via the bundled Apache Plugin (mod_wl/proxy) component in supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a network-based unauthenticated attacker to take over the server over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this is one of the highest-severity issues in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low-complexity, no-privilege, no-interaction profile makes it a top-priority patch.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware, OIM Legacy UI component) allows an unauthenticated network attacker to fully compromise the identity governance server via the T3 and IIOP protocols. Oracle rates it CVSS 3.1 9.8 with high confidentiality, integrity and availability impact and describes it as 'easily exploitable', meaning a successful attack yields complete product takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low complexity and unauthenticated network vector make it a top-priority patch.
Complete takeover of Oracle Access Manager is possible when an unauthenticated attacker with network access sends crafted HTTP requests to the Authentication Engine component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0 and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). It was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Remote unauthenticated takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) allows an attacker with only HTTP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 9.8 (Critical) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, credentials, or user interaction are needed. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete compromise makes this a high-priority patch item.
Full remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) versions 12.2.1.4.0 and 14.1.1.0.0 is possible by an unauthenticated attacker sending crafted traffic over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as 'easily exploitable,' meaning no special skill or configuration is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
Complete takeover of Oracle Coherence is possible when an unauthenticated remote attacker reaches the Core component over HTTPS, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and the CVSS 3.1 base score of 9.8 reflects full confidentiality, integrity, and availability compromise with no privileges or user interaction. No public exploit identified at time of analysis, but the low attack complexity and 'easily exploitable' framing from Oracle make this a high-priority patch.
Remote takeover of Oracle Coherence (Core component) allows an unauthenticated attacker with TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no required privileges or user interaction. No public exploit identified at time of analysis, but the trivial exploitability and full-takeover impact make this a high-priority patch for affected Fusion Middleware deployments.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special conditions are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and complete-takeover impact make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core) is possible by unauthenticated attackers with TCP network access, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 and described by Oracle as 'easily exploitable,' allowing complete takeover of the in-memory data grid across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a high-priority patch.
Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP against the Core component in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with full confidentiality, integrity, and availability compromise (CVSS 9.8), fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so exploitation is currently theoretical but the barrier is minimal.
Full remote takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) in versions 12.2.1.4.0 and 14.1.1.0.0 is achievable by an unauthenticated attacker with only HTTP network access, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with High Confidentiality, Integrity, and Availability impact (base score 9.8). Oracle rates it 'easily exploitable' and describes the outcome as complete compromise of Coherence. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-access profile makes it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Remote code execution and full takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows an unauthenticated attacker with HTTP network access to completely compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and 'takeover' impact make it a top-priority patch candidate.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) can be achieved by unauthenticated remote attackers sending crafted HTTP traffic, affecting versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special preconditions are required. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Complete takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, affecting the Core component in Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch item.
Remote takeover of Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) is possible by an unauthenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, affecting supported versions 17.0 through 26.3. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the unauthenticated network-facing profile makes it a high-priority patch item.
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Retail Integration Bus 14.1.3.2 (RIB Kernel component) allows a remote, unauthenticated attacker to take over the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Memory corruption in Mozilla Firefox 152 and Firefox ESR 140.12 could allow attackers to run arbitrary code within the browser, per Mozilla advisories MFSA2026-68 and MFSA2026-70. The flaw is a batch of internally-discovered memory safety bugs (CWE-119) affecting the Firefox rendering/JavaScript engine, at least some of which showed evidence of exploitable memory corruption. No public exploit identified at time of analysis; the issues were reported by Mozilla itself and fixed in Firefox 153 and Firefox ESR 140.13.
Memory corruption in Mozilla Firefox 152 lets a remote attacker who lures a victim to a malicious web page trigger memory-safety violations that Mozilla assesses could be leveraged for arbitrary code execution. The flaw is one of a batch of internally-discovered memory safety bugs (CWE-119) rolled up under MFSA2026-68 and carries a CVSS 9.8 rating; there is no public exploit identified at time of analysis, and it is fixed in Firefox 153.
Memory-corruption in Mozilla Firefox ESR 115.37 and 140.12 could allow attackers to run arbitrary code by triggering memory-safety bugs (CWE-119) that Mozilla observed showing evidence of memory corruption. Reported by Mozilla and tracked under advisories MFSA2026-69/70, the flaw is remotely reachable and carries a CVSS 9.8, though there is no public exploit identified at time of analysis and no active-exploitation (KEV) listing. Mozilla explicitly frames exploitation as presumptive ('with enough effort'), indicating no confirmed working exploit.
Memory-corruption via integer overflow in the Audio/Video Playback component of Mozilla Firefox lets a remote attacker who serves crafted media content trigger heap corruption that can lead to arbitrary code execution in the browser process. All Firefox versions prior to 153 are affected, and the NVD-assigned CVSS 3.1 base score of 9.8 (network vector, no privileges, no user interaction) reflects a full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the score reflects potential rather than observed exploitation.
Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sensitive information disclosure in DayuanJiang next-ai-draw-io 0.4.13 lets a remote attacker spoof the X-Forwarded-For HTTP header to impersonate a trusted client address and bypass IP-based access controls, exposing protected data. The flaw is classified as authentication bypass by spoofing (CWE-290) and, per the CVSS vector, requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS probability is low at 0.22%.
SQL injection in WGCLOUD 3.6.4 lets remote attackers inject arbitrary SQL through unsanitized parameters bound in the PortInfoMapper.xml MyBatis mapper, enabling database manipulation that can be leveraged to escalate privileges within the monitoring platform. The flaw is remotely reachable and rated critical (CVSS 9.8), with publicly available exploit code exists in the form of a detailed write-up, though EPSS remains low (0.20%, 10th percentile) and there is no public exploit identified as actively used. WGCLOUD is an open-source IT infrastructure/host monitoring system, so a compromise exposes credentials and monitoring data for every managed host.
Privilege escalation via SQL injection in Crocus version 1.3.44 allows remote attackers to manipulate backend database queries through the DeviceInfoMapper.xml data-access layer, yielding full read/write control over application data. The flaw carries a CVSS 9.8 (network, no authentication) rating, and publicly available exploit code exists in a GitHub write-up, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.20%, 10th percentile).
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the shared memory backing file corrupt adjacent stack frames. The attach-time header validator (ring_validate_header) checks capacity-overflow and total_size consistency but never bounds elem_size, so ring_read_seq memcpys a file-controlled length into a fixed 8-byte destination scalar. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and it is not on CISA KEV, but the memory-corruption primitive is unambiguous and a vendor patch (0.04) exists.