SSRF protection bypass in Mastodon's IPv6 address normalization allows unauthenticated remote attackers to route application-layer HTTP requests to loopback interfaces and internal services by supplying IPv4-compatible IPv6 addresses (e.g., ::127.0.0.1) that the PrivateAddressCheck guard failed to recognize as private. All Mastodon instances prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are affected; the flaw stems from a single missing branch in app/lib/private_address_check.rb that checked ipv4_mapped? but omitted ipv4_compat?. No public exploit has been identified at time of analysis, but the patch diff is minimal and publicly visible, making independent reconstruction straightforward.
Red Hat multicluster-global-hub misconfigures topic-level access controls during ManagedClusterMigration, exposing bootstrap kubeconfigs - containing API server tokens - to any managed hub that reads the shared communication topic. A compromised managed hub can silently harvest these credentials, which carry an approximately 9.86-year validity window, enabling long-lived unauthorized access to other managed clusters well beyond the migration event itself. No public exploit has been identified at time of analysis, but the extended token lifetime dramatically amplifies post-compromise dwell risk.
Onebox allowlist bypass in Discourse (all versions prior to 2026.1.7) enables authenticated forum users to embed malicious iframes and attacker-controlled content in posts by exploiting a regex prefix-matching flaw in the `origins_to_regexes` method. The core defect - missing URL boundary anchors and an overly permissive wildcard expansion - allows domains like `youtube.com.attacker.example` to pass validation as the allowlisted `youtube.com`. No public exploit has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; vendor-released patches exist as versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Infinite-loop denial-of-service in libexpat before 2.8.3 allows attackers supplying crafted UTF-16 XML to hang the parsing process indefinitely via a low Unicode surrogate handled as a high surrogate in the *_toUtf16 functions. The flaw is gated by a compile-time prerequisite - only builds configured with XML_UNICODE and XML_UNICODE_WCHAR_T are vulnerable - which specifically includes Firefox and Windows-native builds of applications embedding libexpat. A concrete attack payload is publicly available in the upstream patch PR test suite; no active exploitation has been confirmed via CISA KEV at time of analysis.
LearnPress WordPress plugin before version 4.4.4 exposes a blind, bounded server-side request forgery (SSRF) exploitable by users holding the instructor role, allowing the WordPress server to issue HTTP requests to arbitrary external hosts chosen by the attacker. Reported by WPScan and tracked under CWE-918, the flaw stems from absent URL validation on a user-controllable input. A public proof-of-concept exists; however, EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate negligible observed exploitation activity, consistent with the high-privilege requirement.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Cache poisoning in CoreBunch/Instatic through version 0.0.14 allows unauthenticated remote attackers to corrupt the shared process-wide render cache by supplying a crafted originating-page URL via the `u` query parameter of the server island endpoint `GET /_instatic/hole/<nodeId>`. Because the cache is keyed solely on `nodeId` without incorporating the `u` value, a single poisoning request causes every subsequent visitor requesting that node to receive attacker-controlled fragment content. No public exploit code has been identified and no CISA KEV listing exists; the product's early-stage, niche deployment footprint limits real-world blast radius, but the unauthenticated network vector and low attack complexity make exploitation straightforward against exposed instances.
Samsung Dialer on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes SIM-related functions to remote attackers through improper input validation, requiring user interaction to trigger. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H) classifies this as a network-reachable, high-confidentiality-impact flaw, though high attack complexity and specific prerequisites substantially reduce the realistic threat surface. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in Cybozu Garoon allows a low-privilege authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other logged-in users. The scope-changed CVSS vector (S:C) confirms this is a persistent or reflected XSS capable of crossing session boundaries, enabling high-integrity impact against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but JPCERT/CC coordinated disclosure signals active vendor engagement.
Unrestricted file upload via shell_exec in SaiAdmin up to version 5.0.1 exposes the Plugin Upload Endpoint (/app/saipackage/install/upload) to potential remote code execution by authenticated high-privilege users. The affected function passes uploaded plugin content through shell_exec without adequate file-type validation, a pattern consistent with CWE-434 that typically enables server-side code execution beyond simple file storage. A proof-of-concept exploit has been publicly disclosed on GitHub (CVE-2026-19383 issue), raising the operational risk above what the conservative VulDB-assigned CVSS 4.0 score of 5.1 might suggest; no vendor patch has been identified at time of analysis.
Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-in-the-middle interception, allowing unauthenticated network-positioned attackers to retrieve operation logs and activity logs stored on the devices. Both models from Ecovacs Robotics fail to verify server certificates during MQTT sessions, meaning a rogue server can impersonate the legitimate cloud backend without detection. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor advisory with remediation guidance was published on 2026-03-31 as referenced by JPCERT.
Account takeover via recovery-code bypass in AnythingLLM 1.0.0-1.15.0 allows an unauthenticated remote attacker to seize full control of any user account, including administrator accounts, in multi-user mode. The flaw resides in server/utils/PasswordRecovery/index.js: raw recovery codes are deduplicated before whitespace trimming, so a single code submitted twice with differing surrounding whitespace satisfies the two-distinct-code requirement, and the hash-matching loop does not consume matched hashes, permitting one known code to match the same stored bcrypt hash twice. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but the technique is directly derivable from the published GitHub advisory GHSA-vv8w-wg6r-hq56.
Memory leak exploitation in Almico Speedfan 4.52 is constrained to local, high-privilege access and produces limited availability degradation via the speedfan.sys kernel driver's MSR Index Handler. The vulnerability resides in the KiSystemCall64 handler path within speedfan.sys, where kernel pool memory is allocated but never released during MSR index processing, enabling gradual resource exhaustion on affected Windows hosts. A publicly available proof-of-concept exists, no vendor patch has been issued, and the vendor has not responded to coordinated disclosure.
Local availability degradation in Mullvad's wireguard.sys kernel driver 0.10.1 stems from improper reference count management (CWE-911) within the AdapterState function of the IOCTL handler. An attacker with high local privileges can trigger this defect to cause driver instability or crash the WireGuard adapter, impacting VPN connectivity. A public proof-of-concept exploit exists; however, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and carries a CVSS 4.0 score of 4.6, reflecting its constrained impact and access prerequisites.
Null pointer dereference in OP-TEE OS through version 4.10.0 allows a low-privileged Normal World process to crash the entire Trusted Execution Environment by opening a session directly on the Widevine pseudo-TA when CFG_WIDEVINE_PTA is enabled. The open_session handler in core/pta/widevine.c calls is_user_ta_ctx(session->ctx) without first checking that session is non-NULL, faulting the TEE at S-EL1 and making all TEE services - including secure key storage and other Trusted Applications - unavailable until reboot. No public exploit code exists and no CISA KEV listing is present; the upstream fix is confirmed by commit 0aadfc2 and the CVSS 4.0 score of 5.7 reflects the local, low-privilege, configuration-dependent exploitation conditions.
Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Signed integer overflow in GIMP's file-fli plugin causes application crashes when processing maliciously crafted FLI animation files, resulting in denial of service. The flaw affects GIMP as packaged on Red Hat Enterprise Linux 6 through 9, where incorrect multiplication of image width and height during buffer size calculation can overflow a signed integer, producing an invalid allocation. No public exploit code or active exploitation has been identified; impact is strictly limited to availability, with no confidentiality or integrity consequences.
Unbounded memory allocation in Keras (keras-team/keras) versions ≤ 3.15.0 allows an attacker who can supply a crafted .keras or HDF5 weights file to crash the loading process via an out-of-memory condition. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py performs no validation of HDF5 dataset shapes against actual on-disk storage, enabling 'shape bomb' files that declare enormous in-memory sizes (e.g., ~8 PiB) while occupying negligible disk space. ML pipelines that consume models from public repositories, third-party registries, or untrusted collaborators are directly at risk; this flaw bypasses the earlier fix for CVE-2026-0897, which only addressed the same class of issue in KerasFileEditor. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
systemd-oomd exposes an IPC API that local unprivileged users can abuse to terminate arbitrary processes on the host due to a missing path traversal validation (CWE-22). Any user holding a local shell account can craft IPC requests with traversal sequences to reference processes outside the intended cgroup scope, enabling targeted denial-of-service against critical system services. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sensitive guest disk contents are exposed to any local user on Red Hat Enterprise Linux KVM hosts due to `qemu-img` creating new volume image files with world-readable permissions during libvirt storage clone or convert operations. Affected platforms span RHEL 6 through 10 and RHEL for Nvidia 26. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, but the CVSS C:H rating reflects full guest disk exposure to a low-privileged local attacker.
Stored XSS in Discourse's staff action log interface allows authenticated users to inject malicious HTML into log entries that execute in administrator browser sessions. All Discourse releases prior to 2026.1.6 are affected, with the root cause being an unescaped rendering of previous_value and new_value fields in the admin frontend model. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches across four stable branches confirm the issue is fully remediated.
Rocket.Chat's WebSocket stream-notify-user mechanism lacks sender verification, enabling any authenticated user to inject arbitrary notification bodies into another user's active chat session. Affected versions span multiple release branches prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1. No public exploit or CISA KEV listing has been identified; the primary real-world risk is social engineering and phishing via convincing fake messages rendered in the victim's UI.
Stored XSS in Bludit 4.0.0-beta allows an authenticated Author-role user to plant persistent JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload.php endpoint accepts SVG files permitted by ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES but moves them directly to the web root via Filesystem::mv() without invoking the available sanitizeSVG() or transformImage() routines, leaving embedded script payloads fully intact and serving them to every subsequent site visitor. No CISA KEV listing or public exploit code was identified at time of analysis; however, the scope-change characteristic (S:C) and persistent delivery to all site visitors - including administrators - amplify practical impact beyond the moderate CVSS 5.4 score.
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG file in the application's web root by spoofing the HTTP Content-Type header during upload. The root cause is that the PutMultipart function in pkg/rclonefs/base.go trusts the client-supplied Content-Type value rather than inspecting actual file bytes, allowing an attacker to rename an SVG to .jpg while declaring image/svg+xml and fully bypass the MIME allow-list. When a privileged user later browses to the stored file URL, the browser renders the SVG and executes the embedded JavaScript in that user's session context - a scope-changing impact that elevates the real-world risk above what the medium CVSS score alone suggests. No public exploit has been identified at time of analysis.
Stored cross-site scripting in cube-root/directory-serve through version 1.3.7 enables any authenticated user who can upload files to inject persistent JavaScript into the file listing viewed by other users. The root cause is unsanitized filename rendering in lib/helper/html.js at line 28, where filenames containing HTML attribute-breaking characters are embedded directly into HTML templates. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the stored nature of the XSS and the low-privilege upload requirement make it a realistic lateral attack vector in shared-use deployments.
Reflected XSS in HCL BigFix Mobile allows authenticated attackers to inject and execute malicious scripts in the browsers of other authenticated users by crafting malicious URLs containing unsanitized payloads. The CVSS Scope:Changed attribute (S:C) indicates the injected script executes outside the vulnerable component's security boundary - enabling session hijacking, credential theft, or unauthorized administrative actions against higher-privileged victims. No public exploit code and no CISA KEV listing exist at time of analysis, though the vendor has self-disclosed via advisory KB0132661.
Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Onebox domain blocklist bypass in Discourse allows forum users to circumvent administrator-configured content restrictions by exploiting case-sensitive hostname comparison in `Onebox::DomainChecker.is_blocked?`. Versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are affected across all maintained release branches. An attacker with a forum account can post a link whose redirect target hostname uses mixed casing (e.g., `BLOCKED-Domain.Com`) to evade blocklist enforcement and cause Discourse to render a rich link preview of content the administrator intended to restrict. No public exploit has been identified and the vulnerability is absent from CISA KEV.
Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream.
Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.
Unauthorized tag enumeration in Discourse exposes restricted tag names and descriptions to unauthenticated users via the /site.json endpoint. The flaw exists in all Discourse releases prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, where the anonymous site serializer populates default navigation menu tags from SiteSettings without invoking the DiscourseTagging.filter_visible visibility guard. Attackers can trivially enumerate tag names and descriptions that administrators have restricted to specific categories, category tag groups, or tag-group permission rules, undermining Discourse's information compartmentalization model. No public exploit code or active exploitation has been identified at time of analysis.
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.
GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. No public exploit or CISA KEV listing exists at time of analysis, but exploitation requires no authentication and is trivially automatable.
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses to any authenticated platform user via the account following-list API endpoint. The get_following() function incorrectly serializes the followed user's email field alongside non-sensitive metadata such as name, user ID, and follow date, despite email being absent from comparable user-list endpoints in the same codebase. An authenticated attacker can systematically follow accounts to harvest the full platform user directory's email addresses; no public exploit code or CISA KEV listing has been identified at time of analysis.
Terminal escape sequence injection in npm-check-updates through 23.0.2 enables a supply-chain attacker who controls a malicious npm package's metadata to embed arbitrary VT100/OSC control sequences in the `homepage` or `repository` URL fields of `package.json`. When developers run `ncu --format homepage` or `--format repo`, these unfiltered sequences are written directly to the terminal, allowing output overwriting via bare carriage returns, terminal title hijacking via OSC sequences, and other display manipulation on developer workstations or CI runners. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix PR's test suite demonstrates the exact attack pattern using OSC title-setting sequences and CR overwrites.
Cross-team credential disclosure in the Apache Airflow Microsoft Azure provider's Key Vault secrets backend allows any authenticated team member to read credentials belonging to a different team in multi-team deployments running versions prior to 14.1.0. The backend's team-scoped lookup falls through to a team-agnostic resolution when the scoped lookup misses, and an attacker in one team can deliberately trigger this by supplying a connection or variable ID whose normalized form encodes the target team's namespace prefix. No public exploit has been identified at time of analysis, but the attack primitive is directly derivable from the published patch diff, making this a credible insider-privilege escalation risk for any organization using this backend in multi-team mode.
Improper input validation in the Galaxy Themes application on Samsung Mobile Devices allows a physical attacker to launch arbitrary Android activities, with a high confidentiality impact on the vulnerable system. Affected devices are those running Galaxy Themes prior to the SMR Aug-2026 Release 1 security update. The vulnerability is tagged as an information disclosure issue, and while it requires physical device access and active user interaction, exploitation could allow access to sensitive device data or protected application screens that would otherwise be restricted. No public exploit has been identified at time of analysis, and no KEV listing exists.
Stored XSS in Magnolia CMS's import functionality enables authenticated editors to embed arbitrary JavaScript inside an uploaded image's filename, which executes in the browser of any CMS user who subsequently opens that image. The attack requires low-privileged editor access and passive victim interaction within the CMS backend. No active exploitation has been confirmed (not listed in CISA KEV), no public POC exists, and a vendor-released patch is available in version 6.3.10 as reported by CERT-PL.
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.
Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expose the root account to compromise via physical access. An attacker who obtains physical access to an affected device can recover the root password, gaining privileged control over the embedded Linux system. Reported by JPCERT and disclosed via JVN advisory JVNVU92804348, no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can physically insert a prepared USB storage device. The firmware resolves symbolic links placed on external USB media without validating that the resolved path remains within the intended storage boundary, enabling unauthorized read access to device-internal files such as configuration and credential stores. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor has confirmed patches for all affected models.
Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.
Stored XSS in ReadyEcommerce before 4.5.2 allows authenticated customers to inject arbitrary JavaScript into chat and support ticket messages, which executes in the browsers of any shop owner or administrator who views the messages. The root cause is unsanitized rendering via Vue.js's v-html directive across four frontend components, bypassing the framework's built-in template escaping protections. Successful exploitation can lead to session cookie theft and full administrative account takeover. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds memory write in libsmsd.so affects all Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1, exploitable by a local unprivileged attacker with no special privileges required. The flaw in Samsung's SMS daemon shared library allows memory corruption that could destabilize the smsd process or, with additional technique, enable code execution within the daemon's privilege context. No public exploit identified at time of analysis, and no CISA KEV listing; however, low attack complexity combined with zero privilege requirements makes this actionable for any malicious app or shell-level actor on an unpatched device.
Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.
Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.