Unauthenticated peer-record tampering in the RustDesk API server (lejianwen/rustdesk-api) through version 2.7 lets any remote attacker who can reach the HTTP API overwrite an existing peer's stored hostname, username, OS and uuid by posting only a target device ID to POST /api/sysinfo, after which the attacker can log in with the forged uuid and rebind that peer to their own account. The root cause is an authorization bypass through a user-controlled key (CWE-639): the endpoint never verifies that the submitted uuid belongs to the peer record it is modifying. The independent assessment scores this as remote, low-complexity, unauthenticated and requiring no user interaction but with integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, versus the submitted CVSS 4.0 score of 6.9), and the single prerequisite is that the attacker must know or enumerate a valid existing device ID; no public exploit code and no CISA KEV entry were identified at time of analysis, although a detailed public technical write-up is available.
NivoCart through 2.5.1 emits the expected CAPTCHA answer directly into the HTML of protected public forms, so unauthenticated remote attackers can simply fetch the page, scrape the captcha_image value with a pattern match, and replay it to automate spam, fake registrations, bogus reviews, and account-deletion requests. Severity is moderate rather than critical: the independent assessment rates it CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only, no confidentiality or availability impact), consistent with the published CVSS 4.0 base score of 6.9, because the flaw yields no data disclosure, privilege gain, or code execution. No public exploit code, no CISA KEV listing, and no evidence of active exploitation were identified at time of analysis, and the real-world damage is bounded by the target's own handling of form submissions (e.g., mandatory email confirmation, review moderation).
Unauthenticated server-side request forgery in RedAmon through 7.0.1 allows any attacker who can reach the agent API to make the server issue outbound requests to attacker-chosen URLs via POST /tradecraft/verify, including internal services and cloud metadata endpoints such as 169.254.169.254, with the fetched content returned to the attacker through the model-generated summary. The defect is that the validate_url routine inspects only the initially submitted hostname, so a public URL that returns an HTTP redirect or uses DNS rebinding to resolve into internal address space after the check bypasses the validation entirely (CWE-918). No authentication is required (PR:N per both the CVE 4.0 vector and the independent CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N assessment), the assessed impact is confidentiality-only, and no public exploit code was identified at time of analysis. The practical limiting factor is network reachability of the RedAmon agent API, and the cloud-metadata impact additionally depends on the deployment having a reachable metadata service or sensitive internal endpoints from the server.
Unauthenticated server-side request forgery in ValueCell through 0.1.20 lets any party that can reach the server API set an unvalidated provider base_url and then force the backend to issue requests to attacker-chosen destinations via POST /api/v1/models/check, enabling probing of internal hosts and cloud metadata addresses, leakage of error-response content, and potential capture of stored provider API keys. The flaw is CWE-918 and rated 6.9 (Medium) under CVSS 4.0 with AV:N/AC:L/AT:N/PR:N/UI:N, meaning it is network-reachable and requires no authentication or user interaction; it is not listed in CISA KEV and no public exploit code has been identified at time of analysis, although a public technical write-up documents the attack path. Real-world impact is bounded by deployment context: the API must be reachable from an untrusted network, metadata access requires the instance to run where a link-local metadata service is exposed, and provider-key theft requires providers to already be configured with stored credentials, which our independent assessment reflects with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Unauthenticated attackers can create arbitrary CRM customer records in Craftplan through 0.7.5 by abusing missing authorization on the JSON:API POST /api/json/customers endpoint and the GraphQL create_customer mutation (CWE-862). The issue is remote and requires only network reachability, with impact limited to integrity - insertion of attacker-chosen names, contact details, and addresses into the operator's CRM - without read access to existing records or ability to modify or delete them. Rated CVSS 4.0 6.9 and independently assessed as an integrity-only modest-severity issue, no public exploit identified at time of analysis and no CISA KEV active exploitation is confirmed.
Query-parameter injection in Eclipse Jetty's TryPathsHandler and TryFilesFilter allows unauthenticated remote attackers to inject extra query parameters when a deployment uses a non-default configuration that forwards the request path into a template query string such as index?p=$path. Exposure is limited to sites using that operator-chosen pattern; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and CVSS 4.0 base score of 6.9 describe a medium-severity, configuration-dependent flaw whose realized impact depends on how the backend interprets the smuggled parameters. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can forge unsubscribe and subscribe-confirmation JWTs against BillionMail through version 4.9 because the token signing key is deterministically computed from default configuration constants that ship with the project. By submitting forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm, an attacker who knows the target contact identifier (e.g. an email address) can deactivate that contact or force a subscription to be confirmed. The flaw is remotely reachable with no authentication (CVSS vector PR:N) and no user interaction; there is confirmed KEV status? No - it is not in CISA KEV and no public exploit identified at time of analysis, impact is confined to integrity and availability of subscription state, making this a genuine but moderate-priority issue rather than a critical one.
Heap out-of-bounds reads in libfsapfs through 20260921 can be triggered by a crafted encrypted APFS image, enabling adjacent heap memory disclosure and application crashes. The flaw is an integer underflow in libfsapfs_key_encrypted_key_read_data() that occurs during parsing of malformed HMAC or wrapped KEK attribute lengths, before any password verification, so no encryption key is needed. This local, user-interaction-dependent issue has a medium severity (CVSS 4.0 base 6.9) and no public exploit identified at time of analysis.
An off-by-one stack out-of-bounds read in libxmp through 4.7.4 allows a crafted headerless P61A (ProPacker 61A) module to make the prowizard depacker read one byte past a stack buffer, leaking a small amount of stack memory into sample metadata and/or aborting the module load. The flaw is reachable only when an application built on libxmp opens the attacker-supplied file, so exploitation is local and requires user interaction (no credentials are involved, per the PR:N vector), and the assessed impact is limited to low confidentiality loss with high availability impact - no code execution or data modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is a genuine but moderate-priority concern rather than a top-tier emergency.
Out-of-bounds read in catdoc through 0.95 allows an attacker who can supply a crafted .xls workbook or raw BIFF stream to cause xls2csv to read past its static rec buffer in the MULRK record handler. Exploitation requires that a user or automated service invoke xls2csv on the malicious file, and no authentication is required; the attack is local to the host processing the file, with user interaction required per the independent assessment. Impact is bounded to leaking limited adjacent process memory into CSV output or crashing the conversion process, and no public exploit identified at time of analysis or CISA KEV activity is present in the supplied data; this is assessed as a moderate, not top-tier, priority.
Off-by-one stack out-of-bounds write in libADLMIDI 1.6.2 through 1.6.2.1 lets an attacker corrupt stack memory in the BW_MidiSequencer when a crafted MIDI file is parsed through adl_openFile() or adl_openData(). The trigger is a note-on event with status byte 0x9F and note 0x7F (127), which overruns the noteStates index and can crash the hosting media player or game engine. This is a local, file-based issue requiring the victim to load the malicious MIDI (CVSS 6.9 Medium); no public exploit identified at time of analysis, and the demonstrated impact is denial of service rather than reliable code execution.
Heap out-of-bounds write in libInstPatch through 1.1.7 allows a crafted SoundFont 2 (.sf2) file to corrupt process memory when a victim loads it in Swami or any other application that uses the library's SF2 loader. The flaw lives in ipatch_sf2_gen_is_valid(), which fails to range-check pgen or igen generator IDs before the validity-mask test, so out-of-range IDs cause values to be written past the zone genarray into adjacent heap memory, crashing or potentially corrupting the consumer. The vector is local and requires user interaction (the victim must open the untrusted file), no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, though a public technical writeup describing the root cause is available.
Cache poisoning in Nuxt OG Image 6.2.5 through 6.6.x lets unauthenticated remote attackers overwrite the cached image slot used for a site's legitimate Open Graph image by submitting attacker-controlled rendering parameters (notably the 'title' value) alongside a derived cacheKey to the dynamic /_og/d/*.png route, so spoofed image content is then served to users and crawlers that request the poisoned URL. Both the module's own CVSS 4.0 vector (6.9, AV:N/AC:L/PR:N/UI:N/VI:L) and the independent assessment (CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) agree the impact is limited to integrity of served image content - no code execution, data theft, or availability loss - and that exploitation requires a runtime deployment where URL signing has not been configured. No public exploit code was identified at time of analysis and the issue is not listed as actively exploited, but a fixed release (6.7.0), the upstream commit, and the advisory are all public, so the technical details needed to reproduce the cache-key collision are openly documented. The independent assessment characterizes this as a genuine but moderate-severity integrity issue rather than a top-priority emergency.
Information disclosure in the Vehicle Inspection Certificate Viewer mobile application for Android and iOS causes the app to include API integration credentials - an access ID and an access key - inside the data it transmits, so anyone who can observe or intercept that client-server traffic can recover the credentials. Both platform editions are listed as affected with no version constraint (CPE wildcards for the Android and iOS builds), and the vendor advisory (JVN#94004488, reported to JPCERT) does not identify a fixed release. Exploitation is not trivial: it requires an attacker to obtain a network vantage point such as a man-in-the-middle position on the app's communication path, and there is no public exploit identified at time of analysis; with CVSS 5.3 (C:L/I:N/A:N) the practical impact depends on what the leaked credentials authorize.
An off-by-one heap-based buffer overflow in unarr through 1.1.1 (CWE-193) lets a crafted TAR archive that carries a fully populated ustar prefix field together with a full name field trigger a single out-of-bounds NUL write in tar_get_name() when an application calls the ar_entry_get_name() API. The flaw is reachable without authentication (CVSS PR:N) but is local/file-based (CVSS 3.1 AV:L, UI:R), requiring an application that links unarr to open or process attacker-controlled archive input; the assessed impact is bounded to heap corruption and process crash (availability) with no confidentiality loss and only minor integrity effect. No public exploit identified at time of analysis, the package is not listed in CISA KEV, and no vendor-released patch has been identified.
AdPlug through 2.4 contains a heap-based buffer overflow in the KSM (Ken Silverman Music) module player, CksmPlayer::update() in src/ksm.cpp, where register writes accumulated for a single time slot overflow the fixed databuf[2048] array and corrupt the heap-resident player object. A crafted .ksm module whose notes share one time slot triggers the out-of-bounds write without authentication (CVSS PR:N), but the attacker-supplied file must reach and be opened or played on the target (AV:L, UI:R/UI:P), so the real-world exposure is local and interaction-dependent, with the dominant impact being availability loss (A:H) and minor integrity effects (I:L) rather than code execution. An upstream fix is available in GitHub PR #295; no public exploit code was identified at time of analysis.
Stack-based out-of-bounds read and write in nifti_clib through 3.0.1 allows an attacker who supplies a crafted 540-byte NIfTI-2 header to crash or corrupt stack memory in any application that parses that file through nifti_image_read(). The flaw is unauthenticated per the published CVSS vectors but is local and file-driven: the target must actively open or process the malicious NIfTI-2 file, so there is no remote network-triggered path, and the dominant impact is denial of service (CVSS 6.9, AV:L/AC:L/UI:P, A:H with only I:L and C:N in the independent assessment). No public exploit identified at time of analysis; exposure is confined to software that links the vulnerable nifti_clib versions and accepts untrusted NIfTI-2 header data.
Processing a malicious DSM module file with libmodplug through 0.8.9.1 triggers a heap-based out-of-bounds write in CSoundFile::ReadDSM(), corrupting heap memory and crashing the consuming process. Exploitation is local in nature: it requires a victim to open or load a crafted DSM file whose header declares more than 240 PATT chunks or whose patt_len value wraps, defeating the missing nPat bound against MAX_PATTERNS. Impact is bounded to availability (process crash) with limited integrity effect and no confidentiality disclosure, and no public exploit code was identified at time of analysis; a public technical write-up of the defect exists, and the risk converges on a medium-severity memory-safety issue rather than a top-tier priority.
Decoding crafted iCalendar text that ends in a trailing backslash drives a heap-based out-of-bounds read in libical 4.0.6 and earlier, allowing the attacker to crash the consuming application or expose a small amount of adjacent heap memory. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning a victim must locally open or process the malicious calendar data (for example a crafted .ics file, meeting invite, or subscribed feed) and the dominant outcome is a crash / denial of service, with only limited confidentiality loss rather than code execution; the PR:N component indicates no attacker credentials are needed on the affected host. No public exploit identified at time of analysis, the flaw is not listed in CISA KEV, and an upstream fix exists via the referenced pull request and commit.
Opening a crafted R2004 or R2010+ DWG file with GNU LibreDWG through 0.14.8612 can crash the parsing application and expose a small amount of process memory, because the AcDs data-section decoder indexes a static schema-property-type handler table using an unchecked 'schdat' index. The issue is local and user-assisted: an attacker must deliver the file, and a victim or an automated pipeline must actually parse it with dwgread, dwg2dxf, or any tool linked against LibreDWG; no authentication is required and default configurations are affected (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:L/A:H). No public exploit code was identified at time of analysis, and the practical impact is a medium-severity denial-of-service against DWG-processing workflows plus limited out-of-bounds information disclosure, making this a defense-in-depth file-parsing issue rather than an emergency.
Heap out-of-bounds read in WildMIDI through 0.5.0 allows attackers to crash applications or disclose adjacent heap bytes by supplying a crafted .hmp file with an HMP chunk length of 0-12 that underflows to roughly 4 GB. Exploitation is local and file-driven: the target application or user must load the malicious .hmp file, reaching _WM_ParseNewHmp() with no authentication or special privileges required, and the impact is limited to denial of service or heap information exposure via WildMidi_GetInfo() with no code-execution or write primitive. This is a genuine but modest-priority issue, not a high-urgency flaw; no public exploit identified at time of analysis and CISA KEV does not list active exploitation.
A heap out-of-bounds read (CWE-125) in libyal's libfwsi shell-item parsing library, through the 20260522 snapshot, lets a crafted MTP volume shell item read past allocated buffer bounds inside libfwsi_mtp_volume_values_read_data(), typically crashing the consuming process. The issue is triggered locally and requires the victim to actively open or process an attacker-supplied Windows shell-item artifact - a .lnk file, a jump list, or a shell bag - that embeds a 10 to 53 byte MTP volume shell item declaring an item data size of 44 bytes or more; no attacker privileges are required (CVSS 4.0 base 6.9, PR:N). Practical exposure is limited to environments that actually run libfwsi-based parsers, such as digital-forensics and timeline tooling, and the realistic outcome is process termination (availability impact rated High) with only limited information disclosure possible; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Heap out-of-bounds read in libfwsi (libyal) through version 20260522 allows an attacker to craft an MTP file entry shell item that makes a libfwsi-based parser read past the end of a heap buffer, crashing the consumer and potentially disclosing a small amount of adjacent heap memory. The trigger is a shell item of 10-73 bytes whose declared item data size is 44 or more, embedded in a Windows .lnk file, jump list, or shell bag that the victim's tooling later loads or analyzes; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning local delivery, no privileges required, passive user interaction, high availability impact and only limited confidentiality impact. No public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and the practical outcome is a denial-of-service crash in DFIR/shell-item tooling (for example plaso) rather than remote code execution.
Rendering a crafted XPS document drives GNOME libgxps through 0.3.2 (the renderer used by consumers such as Evince) into a heap out-of-bounds read inside path_geometry_start_element(), allowing an attacker to crash the consuming application and leak adjacent heap bytes into rendered output. The trigger is a PolyBezierSegment or PolyQuadraticBezierSegment Points attribute whose point count is not a multiple of three (bezier) or two (quadratic), so exploitation is limited to a local, file-based attack that requires the victim to open or render the malicious document via user interaction (CVSS 4.0 AV:L/UI:P, PR:N) with no authentication or privilege bypass, no code execution, and only low confidentiality impact alongside high availability impact. An independent assessment scores the flaw 6.9 (medium) using CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, and no public exploit identified at time of analysis despite a public technical writeup documenting the arity mismatch; the affected range is captured by the wildcard CPE cpe:2.3:a:gnome:libgxps:*:*:*:*:*:*:*:*.
Processing a crafted MIRAX whole-slide image with OpenSlide through 4.0.1 can trigger a heap out-of-bounds read in the MIRAX tile-position logic, crashing the consuming application and exposing limited adjacent heap data. The issue is local and user-assisted because a malicious .mrxs/Slidedat.ini must be opened or ingested by a victim or automated pipeline, and it does not by itself enable code execution or persistent data modification. No public exploit identified at time of analysis, and no CISA KEV active-exploitation entry is present in the supplied intelligence.
An out-of-bounds read in catdoc's xls2csv converter lets an attacker who supplies a crafted .xls file cause the tool to read past the end of a heap buffer and emit adjacent memory contents into the converted CSV output, or crash the process outright. The flaw lives in copy_unicode_string() in src/xlsparse.c and is triggered when a LABEL, STRING, or SST record declares 0xFFFF two-byte characters, a count that is consumed without adequate validation against the actual buffer size. All catdoc versions through 0.95 are affected, and exploitation requires a victim or an automated document-processing pipeline to open the malicious spreadsheet with xls2csv; the impact is therefore moderate in human-driven workflows but materially higher where untrusted spreadsheets are converted automatically, and no public exploit code was identified at time of analysis.
CFITSIO through 4.7.0 contains a heap out-of-bounds read in its image decompression routines when processing a crafted FITS file that uses SUBTRACTIVE_DITHER_1 compression and sets the ZDITHER0 seed to zero or a negative value. Triggering the bug requires local access and user interaction to open the file and decode pixels, resulting in a crash (denial of service) and a limited, non-targeted leak of heap memory into decoded pixel values. No public exploit code or active exploitation has been identified, and the issue is best characterized as a moderate-priority file-parsing bug rather than a remote code execution threat.
sdbootutil on SUSE Linux Enterprise Server 16.1, SLES for NVIDIA 16.1, openSUSE Leap 16.1, and Tumbleweed creates a world-readable debug log at /var/log/sdbootutil.log, enabling any local user to read potentially sensitive information from it. This local information disclosure (CWE-732) requires that the debug log has been generated and contains secrets. No public exploit has been identified at time of analysis, and the issue is not known to be actively exploited.
Out-of-bounds write in FluidSynth (versions through 2.6.1) allows an attacker to corrupt heap and stack memory by getting a crafted SF2 SoundFont loaded and played - unvalidated PMOD/IMOD modulator destination values of 63 to 255 are used to index the per-voice generator array and updated_gen_bit bitfield without bounds checking. Because the attack vector is local and the victim (or an application acting on their behalf) must open or play the malicious SoundFont, the realistic impact is memory corruption and application crashes (availability) rather than code execution or data theft. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the write-up and source references point to a code-review/crash class of issue rather than an urgent, remotely exploitable defect.
A heap out-of-bounds read in libmikmod's IMF_Load() loader (CWE-125) lets a crafted Imago Orpheus (IMF) module map notes to sample indices far past the allocated sample table, crashing any application that parses the file with libmikmod 3.3.15 or earlier. Exploitation is local and requires the target application to load attacker-supplied IMF content, with no privileges or authentication needed, so the practical impact is denial of service against media players, trackers, and game engines that link the library. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 6.8 reflects high availability impact with no demonstrated confidentiality or integrity loss.
Denial of service in WildMIDI through 0.5.0 occurs when an application using the library opens or decodes a crafted HMI file that places a 0xfe 0x10 sub-event near the end of the input buffer. The _WM_ParseNewHmi() routine in src/f_hmi.c performs a heap out-of-bounds read of up to four bytes past the allocation, crashing the decoder; the issue is CWE-125 and cannot be triggered remotely without local file delivery and user interaction, and the over-read does not expose the four bytes to the attacker. Independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (low-to-moderate real-world risk, below the headline CVSS 4.0 score of 6.8), and no public exploit identified at time of analysis.
Parsing a crafted Ogre3D asset pair with Assimp through 6.0.5 crashes the host process: the importer resolves a submesh bone index that does not exist in the accompanying skeleton, BoneById() returns null, and the unchecked result is dereferenced in OgreStructs.cpp. The impact is availability-only - no code execution and no data disclosure - and exploitation requires the victim application to import the attacker-supplied .mesh and .skeleton files (local attack vector with user interaction, no authentication needed), so real-world risk is concentrated in workflows that routinely ingest untrusted 3D models. No public exploit code is identified in the available data and the issue is not listed in CISA KEV, although a public technical writeup of the crash path is referenced.
Heap-based out-of-bounds read in unarr through 1.1.1 lets a crafted ZIP archive crash any host application that links the library and passes it attacker-controlled input. The defect is in zip_parse_extra_fields() in zip/parse-zip.c, where an incorrect length check on the ZIP64 extra-field record allows reads past the end of a heap buffer when an archive supplies 0xFFFFFFFF sentinel values together with a truncated ZIP64 record; the demonstrated impact ceiling is a denial of service (process crash), with no confidentiality or integrity compromise and no code execution indicated. Exploitation requires the malicious archive to reach the victim and be opened or processed by the vulnerable application (local attack vector, passive user interaction, no privileges required), and no public exploit identified at time of analysis - this is a moderate-severity, low-priority issue rather than an urgent one.
Heap-based out-of-bounds read in LibRaw through 0.22.2 allows a crafted Nikon NEF/TIFF file to crash applications that decode it. The flaw lives in LibRaw::parseNikonMakernote(), where a malformed 5-byte ShotInfo makernote tag declaring version 243 causes the parser to read past the end of a short buffer; because the file must be opened or processed by the victim (CVSS vector PR:N but AV:L/UI:P in the v4.0 score, and AV:L/UI:R in our independent v3.1 assessment), an attacker cannot trigger it remotely on their own. Impact is assessed as availability-only - no confirmed memory disclosure, code execution, or privilege gain - and no public exploit code or confirmed active exploitation was identified at time of analysis, though a technical writeup and the affected source lines are publicly linked. This is a moderate-risk availability flaw, not a top-priority emergency.
Crafted AMS (Velvet Studio) module files can crash any application that uses libmodplug 0.8.9.1 or earlier by triggering a heap-based out-of-bounds read in CSoundFile::ReadAMS2(). The attacker must deliver a specially formed AMS file whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer; the victim must then open or process the file, and no authentication is required. The issue is a local, client-side denial-of-service (CVSS 6.8) with no confirmed confidentiality or integrity impact, and no public exploit code or active exploitation has been identified at time of analysis.
Loading a crafted MultiTracker (.mtm) module file with a declared channel count above 32 in applications linked against libmikmod through 3.3.15 triggers an out-of-bounds read in MTM_Load(), crashing the process. The flaw is a medium-severity local denial-of-service issue (CVSS 4.0 base 6.8) requiring user interaction to open or process the malicious file; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in UADE through 3.05 crashes applications that probe or play attacker-supplied Amiga module files, because an unsigned length subtraction in uade_filemagic() wraps around on deliberately short inputs. The malformed module must be small enough to slip past the format-probe bounds checks in amifilemagic.c yet trigger the bufsize underflow, after which the code reads far past the end of the buffer. Impact is limited to a denial of service, typically a segmentation fault that terminates the host player or library consumer; the attack requires the crafted file to be opened locally and the user to trigger the probe/playback path (CVSS:3.1/AV:L/PR:N/UI:R, availability-only), with no code execution, privilege gain, or data disclosure. The affected software is a niche Amiga emulation/audio library with limited deployment, so real-world risk is moderate; no public exploit identified at time of analysis, and the CVE is not in CISA KEV.
Processing a crafted ZIP archive with zziplib through 0.13.80 can cause a denial-of-service (crash) via an out-of-bounds read in the mmapped parsing path (zzip/mmapped.c). This local attack requires the victim to open the malicious file (passive user interaction) and no authentication, but results only in a crash (CVSS 4.0 base 6.8, availability impact only). No public exploit code or active exploitation has been identified at time of analysis.
assimp through 6.0.5 is susceptible to a NULL pointer dereference when parsing a crafted Ogre3D .mesh file with a morph animation track that references a missing submesh or absent shared geometry, crashing the host process. The flaw requires user interaction (passive, such as opening or importing the file) and no privileges are needed on the victim's system; no public exploit code is identified at time of analysis. This is a moderate-severity, availability-only issue with no impact on confidentiality or integrity.
An out-of-bounds write in the Lenovo Energy Management kernel-mode driver lets a local authenticated user crash the affected Windows host with a blue-screen (kernel bugcheck) error, producing a denial-of-service condition on systems where the driver is installed and loaded. The flaw is availability-only: the assessed impact is kernel memory corruption leading to a crash, with no demonstrated path to code execution or data disclosure, and it requires the attacker to already hold a local session on the machine (PR:L) - there is no network-reachable attack surface. No public exploit code and no evidence of active exploitation were identified at time of analysis, so this should be treated as a moderate-severity, patch-and-move-on item rather than an emergency; the vendor advisory is Lenovo LEN-218444.
Directory traversal in Grav CMS versions 2.0.3 through 2.0.6 allows authenticated remote attackers with low privileges to read arbitrary sensitive files on the server. The flaw exists in the mediaDirFunc Twig method within GravExtension.php, where crafted path sequences can escape the intended media directory. No public exploit has been identified at time of analysis, and the CVSS 3.1 vector (6.5) reflects high confidentiality impact with no integrity or availability effects.
Opening a specially crafted PowerPoint document in an unpatched Microsoft Office build can trigger an out-of-bounds read that leaks the contents of process memory to the attacker. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the corresponding Office for Mac / LTSC for Mac 2021 and 2024 clients; exploitation is remote and needs no credentials (AV:N/PR:N) but hinges entirely on user interaction (UI:R), since the victim must open or preview the malicious file. The result is read-only memory disclosure (C:H, I:N, A:N) rather than code execution or data tampering, and there is no public exploit identified at time of analysis, though a vendor patch is available per the Microsoft Security Response Center advisory.
An out-of-bounds memory read in Microsoft PowerPoint lets remote attackers leak information from the memory of the affected Office process when a user opens a specially crafted presentation file. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), meaning confidentiality is heavily impacted while integrity and availability are untouched, and it affects Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 on both Windows and macOS. No public exploit has been identified at time of analysis, but the attack path is straightforward: an unauthenticated attacker only needs to convince a victim to open a malicious .ppt/.pptx file, so email and web-delivered documents remain the primary delivery vector. A vendor patch is available through Microsoft's update guide.
An information disclosure vulnerability in Microsoft PowerPoint allows a remote, unauthenticated attacker to trigger an out-of-bounds memory read by convincing a victim to open a specially crafted presentation file, potentially exposing heap contents that may contain sensitive data. Affected builds span Microsoft 365 Apps for Enterprise, Office 365 for Mac, and the Office LTSC 2021 and 2024 releases on both Windows and macOS. The attacker needs no credentials (PR:N), but the attack hinges entirely on user interaction (UI:R) - the document must be opened, and Protected View or Mark-of-the-Web handling for externally sourced files can interrupt the chain. Microsoft has released a vendor patch and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Microsoft Word allows a remote, unauthenticated attacker to read memory contents from an affected Office installation by getting a user to open or preview a maliciously crafted Word document delivered over the network, such as an email attachment or a download. The flaw is a use-after-free (CWE-416) that is present in Microsoft 365 Apps for Enterprise and in Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) the impact is limited to confidentiality, with no code execution, integrity, or availability effect. This is a moderate-priority issue rather than a critical one: exploitation is gated by the mandatory UI:R user-interaction requirement, and no confirmed active exploitation (CISA KEV) or publicly available exploit code was identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center advisory.
An out-of-bounds read in Microsoft Word (CWE-125) lets remote, unauthenticated attackers disclose the contents of process memory when a victim opens a specially crafted document, with affected builds spanning Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, and Office LTSC for Mac 2021/2024. Exploitation requires the user to open the malicious file (UI:R) and deliver it successfully through social engineering, so it is not a zero-click or wormable flaw, and the impact is limited to information disclosure (C:H, I:N, A:N) without code execution or persistence. No public exploit code has been identified at time of analysis, and Microsoft has published a vendor patch through its update guide.
Information disclosure in Microsoft Word (and the broader Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 families) allows a remote attacker to read memory contents from the affected application by convincing a victim to open a specially crafted document. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): the attacker needs no authentication, but exploitation hinges on user interaction - the target must open the malicious file - so delivery depends on phishing or social engineering rather than automatic remote compromise. Impact is limited to confidentiality (no code execution, integrity, or availability effect) and remains confined to the vulnerable process; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, though the disclosure of high-value memory contents can still expose sensitive document data or session material. Microsoft has published a vendor patch via its MSRC update guide.
An out-of-bounds read in Microsoft Word (CVE-2026-108434, CVSS 6.5) allows a remote, unauthenticated attacker to disclose information from process memory if the victim opens or previews a specially crafted Word document. Affected builds are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, per the vendor CPE list. Because the vector requires user interaction (UI:R) and the impact is limited to confidentiality (C:H with I:N/A:N), there is no zero-click or server-side exploitation path; Microsoft has published a fix through its MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Arbitrary code execution is possible in HPE NonStop Posix User Threads for an authenticated local user with low-level privileges who supplies crafted input to the pthread functionality, due to a heap-based buffer overflow (CWE-122). The flaw requires pre-existing local access (AV:L), no user interaction (UI:N), and no non-default configuration indicated by the available data; there is no public exploit identified at time of analysis. The vendor advisory is at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US, and the independent assessment rates confidentiality, integrity, and availability impact as High despite the vendor's 6.6 Medium base score with Low/Low/High impact.
A stack-based buffer overflow in the HPE NonStop Kernel Level Thread Model library allows a locally authenticated, low-privileged user to overwrite stack memory and, in the assessed worst case, execute arbitrary code in the context of the affected library. The vulnerability is reachable only with local access and valid low-privilege credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely and requires an attacker to already hold a foothold on the NonStop host; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is moderate rather than emergency-grade. Success depends on invoking the vulnerable library from an existing session, which constrains realistic exposure to insiders, compromised local accounts, or post-exploitation privilege-escalation chains on operator-managed NonStop systems.