Omnibox in Google Chrome prior to 153.0.8010.36 permits a remote unauthenticated attacker to bypass system access restrictions and navigate into privileged internal browser pages through a crafted HTML page delivered via social engineering. The root cause is missing authorization (CWE-862) in the Omnibox component, meaning Chrome fails to enforce access controls before allowing navigation to restricted page contexts. No public exploit or active exploitation has been identified; Chromium rates this Medium, consistent with the CVSS 6.5 score and mandatory user interaction requirement.
Incorrect authorization in Chrome's FileAPI implementation allows remote attackers to bypass system-level file access restrictions, resulting in high-integrity impact against the vulnerable system. Exploitation requires social engineering - a user must visit a crafted HTML page - making it a targeted rather than opportunistic threat. No public exploit code or active exploitation has been identified; the Chromium team assigned a 'Medium' severity rating consistent with the CVSS 6.5 score, and a patch is available in Chrome 153.0.8010.36.
Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. No public exploit has been identified at time of analysis, and CVSS UI:R confirms that exploitation requires a user to initiate a connection to an attacker-controlled media source.
Out-of-bounds read in GPAC v26.07.0's HTTP download subsystem (gf_dm_data_received in downloader.c) enables remote denial of service when a victim user processes a crafted HTTP response containing a malformed or pathologically large chunk-size value. The upstream fix commit confirms two root causes: absence of an upper-bound cap on parsed chunk sizes and an unchecked integer overflow in the nbBytes + hdr_size computation that causes accounting to wrap around before the out-of-bounds read occurs. Impact is limited to application crash with no confidentiality or integrity consequences; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Privilege escalation in the HPE Aruba ClearPass OnGuard agent enables an authenticated network-accessible attacker with low privileges to elevate to root on the affected deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring no user interaction, making it straightforward to weaponize for any attacker who holds even a basic account on the system. No public exploit code or CISA KEV listing has been identified at time of analysis; HPE has published advisory hpesbnw05130en_us, which presumably details affected versions and remediation.
Sensitive information disclosure in Google Chrome's Sources component exposes arbitrary sensitive data to remote attackers who can direct a user to a crafted HTML page. The flaw, fixed in Chrome 153.0.8010.36, stems from incorrect authorization checks (CWE-863) in the Sources subsystem - notably the same release that patched a cluster of higher-severity sandbox-escape RCEs. Despite the NVD CVSS score of 6.5 and C:H confidentiality rating, Chromium's own team rates this as Low severity, suggesting limited real-world exposure or constrained scope of the leaked data. No public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the Loader component of Google Chrome prior to 153.0.8010.36 enables a remote attacker to obtain sensitive information by luring a victim to a crafted HTML page. The CVSS base score of 6.5 and Chromium's own 'Medium' severity rating are consistent, reflecting the high confidentiality impact constrained by mandatory user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.23% places this in the 14th percentile for near-term exploitation likelihood.
Relative path traversal (CWE-23) in Dell Secure Connect Gateway 5.0 allows unauthenticated remote attackers to access the underlying filesystem of the appliance or application deployment without credentials. Both form factors - the dedicated Appliance (prior to 5.36.00.16) and the software Application (prior to 5.36.00.00) - are affected. Successful exploitation yields limited file read access (C:L) and high-impact file write capability to arbitrary filesystem locations (I:H), creating conditions for persistent configuration tampering or malicious file placement on a security-adjacent platform. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Google Chrome's Downloads subsystem on Android prior to 153.0.8010.36 improperly enforces its behavioral workflow (CWE-841), allowing a remote attacker to bypass Android system access restrictions via a crafted HTML page combined with social engineering. The attacker achieves high integrity impact - likely the ability to write files or trigger downloads that circumvent Android's permission and access control model - without any confidentiality or availability exposure. No public exploit exists and EPSS sits at 0.22% (13th percentile), placing real-world exploitation risk low despite the network-accessible attack vector.
Missing authorization in Chrome's DOM implementation prior to version 153.0.8010.36 allows remote attackers to potentially leak sensitive information by luring a victim to a crafted HTML page. Rooted in CWE-862 (Missing Authorization), the flaw permits script or page contexts to access DOM nodes or properties without proper access-control enforcement, potentially bypassing intended cross-context isolation. No public exploit code exists and CISA has not listed this in KEV; EPSS of 0.22% (12th percentile) and SSVC Exploitation:none confirm negligible current threat activity.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote low-privileged attacker to extract sensitive data and potentially inject scripts into the application. Affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00), the flaw requires only valid low-privilege credentials and standard network access with no user interaction. Dell has released patched versions and no public exploit code has been identified at time of analysis.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Incorrect authorization in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 allows remote attackers to bypass the web origin policy via crafted network traffic, producing a high-integrity impact with no confidentiality or availability effect. The DeviceBoundSessionCredentials feature, which binds authentication sessions to specific devices to reduce credential theft, fails to correctly enforce origin restrictions under this condition. No public exploit code exists and no active exploitation has been confirmed; the Chromium team rated this 'Medium' and EPSS stands at 0.21%.
Divide-by-zero in GPAC v26.07.0's DASH client crashes the process when parsing a crafted MPD SegmentTimeline containing a zero-duration segment entry, enabling a remote attacker to cause a Denial of Service against any application using GPAC to process MPEG-DASH content. The affected function gf_dash_get_timeline_duration divides by ent->duration without guarding against zero; the upstream fix commit (2fd5a06a) is confirmed available but a tagged patched release has not been independently verified. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap memory disclosure in Cyrus IMAP before 3.12.4 allows authenticated users to leak adjacent heap contents via a crafted JMAP blob ID. By issuing a JMAP blob download request using the internal format H<emailid>-<index> with an index value that exceeds the length of the blob_headers array, an attacker triggers an out-of-bounds read (CWE-125) and receives whatever heap memory follows the array in the server's response. The CVSS 3.1 score of 3.1 (Low) reflects the authentication requirement, high attack complexity, and limited confidentiality impact; no public exploit has been identified at time of analysis.
Safebrowsing information omission in Google Chrome on macOS prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by delivering a crafted HTML page that causes Chrome's Safe Browsing subsystem to silently suppress or lose security-relevant signals. The CVSS vector (PR:N/UI:R/I:H) reflects that a victim need only visit a malicious page, after which Safebrowsing protections fail to surface warnings - exposing users to malicious downloads or sites without Chrome's normal safety guardrails. No public exploit code exists and EPSS is very low (0.20%, 10th percentile); no CISA KEV listing at time of analysis.
Incorrect authorization in Google Chrome's Extensions subsystem (prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension to a victim who interacts with it. The flaw, rooted in CWE-863 (Incorrect Authorization), enables integrity violations - specifically circumventing the permissions and access controls that govern what extension code can do on the host system. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% (9th percentile), consistent with Chromium's own 'Medium' severity classification.
Incorrect authorization in Chrome's WebUI component allows a remote unauthenticated attacker to bypass system access restrictions and gain unauthorized access to privileged internal Chrome pages by luring a victim to visit a crafted HTML page. All Chrome desktop versions prior to 153.0.8010.36 are affected; Google patched this in the stable channel released September 2026. No public exploit has been identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects minimal current exploitation pressure.
Incorrect authorization in the WebAppInstalls subsystem of Google Chrome before 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to bypass Chrome's site isolation via a crafted HTML page combined with social engineering. This is a chained, second-stage exploit - not a standalone vulnerability - requiring a prior renderer compromise before the WebAppInstalls flaw can be weaponized. Chromium rates it 'Medium' and EPSS sits at 0.19%, consistent with the high exploitation prerequisite; no public exploit code or CISA KEV listing exists.
Safebrowsing in Google Chrome prior to 153.0.8010.36 can be bypassed through improper state validation (CWE-754), enabling a remote attacker to suppress Chrome's phishing and malware protection warnings by delivering a crafted HTML page to a victim. The integrity-only impact (CVSS I:H, C:N, A:N) reflects that successful exploitation undermines Chrome's access restriction enforcement rather than directly exfiltrating data, but it clears the path for downstream malware delivery or credential harvesting that Safebrowsing would otherwise have blocked. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.18% (8th percentile) corroborates low current weaponization probability.
Navigation component information leak in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass site isolation and exfiltrate cross-origin data via a crafted HTML page. This is a second-stage exploit component: it cannot be chained without a prior renderer compromise, which significantly elevates the effective attack complexity despite the AV:N/AC:L CVSS surface reading. Chromium's own severity rating is 'Medium', consistent with the prerequisite constraint. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) reflects the elevated bar for exploitation.
Incorrect authorization in Chrome's Omnibox (address bar) prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions and gain unauthorized access to privileged browser pages. Exploitation requires luring a victim to visit a crafted HTML page, making this a social-engineering-dependent integrity attack. No public exploit code has been identified and EPSS sits at 0.18%, consistent with Chromium's own 'Medium' severity rating despite the NVD CVSS score of 6.5.
Site isolation bypass in Google Chrome prior to 153.0.8010.36 allows a remote attacker to subvert cross-origin integrity guarantees by directing a victim to visit a crafted HTML page, exploiting incorrect authorization checks (CWE-863) in Chrome's Isolated component. The CVSS score rates integrity impact as High with no privileges required, but user interaction is necessary and confidentiality impact is assessed as none. No public exploit code exists and SSVC marks exploitation as none; EPSS stands at 0.18%, suggesting low observed threat activity despite the patch being available.
Missing authorization in Chrome's FileSystem component allows a remote attacker to bypass system access restrictions via a crafted HTML page, requiring social engineering to achieve user interaction. Affects all Chrome versions prior to 153.0.8010.36 across desktop platforms. With PR:N and I:H in the CVSS vector, an unauthenticated attacker who tricks a user into visiting a malicious page can achieve high-integrity impact against the local filesystem without confidentiality or availability consequences.
SiteIsolation incorrect authorization in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to bypass cross-origin access restrictions via a crafted HTML page. The flaw (CWE-863) carries a CVSS 6.5 with high integrity impact and no confidentiality or availability dimension, consistent with a second-stage sandbox-escape component rather than a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects very low observed exploitation probability; Chromium's own severity rating of 'Medium' aligns with this assessment.
Missing authorization in Chrome's FileSystem API allows a remote unauthenticated attacker to bypass system-level file access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36. The CVSS vector (I:H, C:N) indicates high integrity impact with no confidentiality exposure, meaning the attacker can write or modify files accessible through the FileSystem API without reading them. No public exploit has been identified and EPSS sits at 0.18% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Improper access controls in Tanium Comply allow an authenticated low-privileged network user to perform write operations beyond their authorization level, resulting in high integrity impact. Three active release branches are affected: 2.32, 2.35, and 2.37, each with specific fixed builds released by Tanium under advisory TAN-2026-029. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the network-accessible, low-complexity vector lowers the bar for exploitation by any authenticated user.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Cross-origin information leakage in Google Chrome's Select element (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to infer sensitive user state by observing behavioral discrepancies in how the `<select>` element renders when a victim browses to a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), a classic browser side-channel class that enables cross-site information inference - for example, whether a user is authenticated to a third-party origin or has visited specific URLs. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with the Chromium team's own 'Low' severity rating despite NVD's CVSS 6.5.
Observable SVG discrepancy in Google Chrome prior to 153.0.8010.36 enables remote attackers to infer sensitive cross-origin information by inducing measurable rendering behavioral differences via a crafted HTML page. The root cause is CWE-203, a side-channel class where an attacker observes system behavior variations to deduce protected state. No public exploit code or active exploitation is identified; Chromium's own 'Low' severity designation and an EPSS of 0.17% (7th percentile) together indicate limited real-world exploitation likelihood despite the NVD's C:H confidentiality metric.
Observable DOM discrepancy in Google Chrome prior to 153.0.8010.36 enables cross-origin information leakage via a CWE-203 side-channel, allowing a remote attacker to infer sensitive data from a victim's browser state. Exploitation requires social engineering to lure the target to a crafted HTML page, satisfying the required user interaction. No public exploit code or CISA KEV listing is associated with this vulnerability, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest at time of analysis.
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. No public exploit has been identified at the time of analysis, and with an EPSS of 0.17% (7th percentile), opportunistic mass exploitation is unlikely in the near term despite the high confidentiality impact rating.
An interpretation conflict (CWE-436) in Google Chrome's Safe Browsing handling on macOS allows a remote attacker to bypass system access restrictions by convincing a victim to open a crafted file, all the way up to and including Chrome 153.0.8010.36. Exploitation requires the victim to interact with the file (CVSS UI:R) and yields an integrity-only impact (C:N/I:H/A:N), which is consistent with Chromium's own 'Low' severity rating despite the 6.5 base score. There is no CISA KEV listing and no public exploit identified; EPSS is only 0.17% (7th percentile), and Google has shipped a fix in version 153.0.8010.36.
Sensitive information disclosure in Google Chrome's Editing subsystem allows a remote unauthenticated attacker to exfiltrate browser-accessible data by luring a user to a crafted HTML page. All Chrome versions prior to 153.0.8010.36 on desktop are affected. No public exploit has been identified and SSVC assigns no active exploitation, making this a low operational priority despite the CVSS 6.5 score.
Sensitive information disclosure in Google Chrome's Transactions Platform component prior to version 153.0.8010.36 enables remote attackers to extract unspecified sensitive data by directing a user to a crafted HTML page. The Transactions Platform is likely tied to Chrome's Web Payments API or payment handler subsystem, making transaction-context data a plausible disclosure surface. No public exploit code exists and EPSS sits at 0.16% (6th percentile); however, the vendor-assigned CVSS C:H metric indicates the leaked data carries meaningful sensitivity, creating a tension with Chromium's own 'Low' internal severity classification.
A crafted series of RTSP and HTTP requests sent to LIVE555 Streaming Media 2026.02.26 triggers a use-after-free in SocketDescriptor::tcpReadHandler1 (liveMedia/RTPInterface.cpp), crashing the media server and terminating all active streams. The flaw is reachable over the network without credentials, and because LIVE555 is embedded in IP cameras, streaming appliances and media servers, one crash can disrupt many downstream viewers at once. No public exploit code and no CISA KEV entry were identified at time of analysis, EPSS places exploitation probability at roughly 0.15% (5th percentile), and the supplied references do not state an exact fixed build number.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a remote low-privileged attacker to bypass cryptographic protection mechanisms, resulting in high confidentiality impact. Both the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) deployment modes are affected. Dell has released corrective updates via advisory DSA-2026-382, and no public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.5) allows authenticated contributor-level users to inject persistent arbitrary JavaScript into episode pages via the episode_contributor comment parameter. The vulnerability is compounded by two design flaws: contributor comments are stored in a plugin-managed custom database table that bypasses WordPress core's wp_kses_post sanitization filter, and the save_post hook fires without a nonce check, removing CSRF protection that would otherwise limit exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.
Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.8.3) allows authenticated contributors to inject persistent malicious scripts via the `fallback`/`substitute` shortcode attributes. The attack exploits a gap between WordPress's save-time and render-time processing: hex-encoded payloads like `\x3cscript\x3e` pass through `wp_kses_post` as harmless literal strings at save time, but WordPress core's `shortcode_parse_atts()` calls `stripcslashes()` at render time, converting those sequences into live angle brackets before they reach the unescaped output sink. No public exploit code or active exploitation (CISA KEV) has been confirmed; the scope-changed CVSS 6.4 rating reflects impact on any visitor to an injected page.
Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.
Stored Cross-Site Scripting in the Graphina - Charts and Graphs For Elementor WordPress plugin (all versions through 3.1.11) allows authenticated contributors to inject persistent malicious scripts via the 'iq_tree_tree_chart_template' widget setting. Because the scope changes (S:C), injected payloads execute in the browser context of any visitor who loads the affected page, enabling session hijacking, credential theft, or drive-by malware delivery. The vulnerability stems from insufficient sanitization of widget input and missing output escaping in the TreeChart rendering path, with specific vulnerable code identified by Wordfence at TreeChart.js:146, tree-chart.php:19, GraphinaFunction.php:1653, and GraphinaElementorControls.php:1446. No public exploit code or CISA KEV listing is confirmed at time of analysis.
Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (≤3.8.3) allows any authenticated contributor to inject persistent JavaScript into site pages via unsanitized shortcode attributes. The payload executes in the browsers of all users who subsequently visit the affected page, potentially enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed; an upstream fix commit is available on GitHub though a tagged release version has not been independently confirmed.
Improper Authentication in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to bypass authentication controls and gain unauthorized access to protected resources, resulting in high confidentiality and integrity compromise. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit or CISA KEV listing has been identified at time of analysis.
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progression by sending multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, causing the server to instantiate duplicate Player objects and amplify both memory consumption and network traffic. The affected code path in ResourcePacksPacketHandler.php lacked a re-entry guard to prevent handler transitions from executing more than once per session. A publicly available exploit exists via the GHSA-pg53-p7qp-65cv GitHub security advisory, though real-world impact is constrained by a CVSS 4.0 score of 2.3 and the requirement for authenticated client connections.
Improper access controls in Tanium Comply allow authenticated low-privileged users to bypass object-level authorization and access or manipulate compliance data belonging to other users or tenants. Affecting three active release branches (2.32, 2.35, 2.37), the flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of vulnerability commonly known as Insecure Direct Object Reference (IDOR). Tanium self-disclosed and patched the issue via advisory TAN-2026-038; no public exploit or active exploitation has been identified at time of analysis.
Unsynchronized multithreaded access in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to cause denial of service and potentially minor data integrity or confidentiality impact. Both the Appliance variant (fixed in 5.36.00.16) and Application variant (fixed in 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis.
WeasyPrint ≤v69.0 silently bypasses application-configured url_fetcher restrictions in two write_pdf() channels, enabling arbitrary local file read and SSRF in server-side PDF rendering pipelines. The xmp_metadata parameter fetches attacker-controlled URLs using the default unrestricted URLFetcher and embeds the response bytes verbatim in the generated PDF, while the stylesheets parameter applies fetched CSS with transitive propagation through @import chains - both ignoring any restrictive fetcher set on HTML(). No public exploit is listed in KEV, but the advisory includes complete working PoC code demonstrating credential file exfiltration.
Unbounded heap growth in MCP Kotlin SDK versions 0.7.0-0.12.0 allows an attacker-controlled byte-stream producer to OOM-kill the hosting JVM process via the stdio transport. The ReadBuffer.append() method writes all incoming data into a kotlinx.io.Buffer with no size cap, and frame extraction only triggers on newline arrival - a peer that never sends a newline causes indefinite accumulation. Both StdioServerTransport and StdioClientTransport compound the exposure by using Channel.UNLIMITED queues with no backpressure, amplifying heap consumption before any size guard could intervene. No public exploit identified at time of analysis; vendor-released patch available in version 0.13.0.