Monthly
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.
Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.
Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.
Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.
Remote code execution in Ubiquiti EdgeMAX EdgeSwitch devices allows an attacker on an adjacent network to fully compromise the switch by exploiting a heap-based buffer overflow in its DHCPv6 handling. The flaw affects EdgeSwitch units that have DHCPv6 enabled and requires no authentication or user interaction, only Layer 2/link-local reachability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.6 rating and network-daemon attack surface make it a high-priority patching target.
Heap-based buffer overflow in FreeBSD's ppp(8) daemon allows a malicious PPP peer to crash the daemon or execute arbitrary code as root. The flaw resides in mp_Enddisc(), which miscalculates buffer lengths when formatting Multilink PPP endpoint discriminator addresses, overflowing a global result buffer. Affected releases are FreeBSD 14.4-RELEASE prior to p9, 15.0-RELEASE prior to p13, and 15.1-RELEASE prior to p3; no active exploitation is confirmed (not in CISA KEV), but SSVC rates the technical impact as total and the attack as automatable.
Heap buffer overflow in Google Chrome's Media component prior to version 152.0.7977.65 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects low attack complexity and no authentication requirement, but the unchanged scope (S:U) confirms execution is sandboxed - a full system compromise would require a separate sandbox escape not described in this CVE. No public exploit code has been identified and no CISA KEV listing exists; EPSS of 0.28% (20th percentile) indicates low observed exploitation activity, which is consistent with a patch-and-monitor posture rather than emergency response.
Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 152.0.7977.65) enables a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted HTML page to a victim user. The CVSS score of 8.8 reflects broad impact (C:H/I:H/A:H) with no authentication prerequisite, though code execution is initially sandboxed and scope is unchanged (S:U). No public exploit code has been identified at time of analysis; SSVC records exploitation status as none and EPSS probability is low at 0.28% (20th percentile), suggesting this has not yet been leveraged at scale despite the high-severity rating.
Heap-based buffer overflow (CWE-122) in Blink, Chrome's rendering engine, grants native code execution within the renderer sandbox to attackers who have already achieved renderer process compromise, affecting all Chrome versions prior to 152.0.7977.65 across all platforms. The fix is confirmed in stable channel release 152.0.7977.65. No public exploit identified at time of analysis; EPSS at 0.28% (20th percentile) and Chromium's own Medium severity rating both reflect the high attack complexity imposed by the mandatory prior-renderer-compromise precondition.
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.
Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.
Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.
Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.
Remote code execution in Ubiquiti EdgeMAX EdgeSwitch devices allows an attacker on an adjacent network to fully compromise the switch by exploiting a heap-based buffer overflow in its DHCPv6 handling. The flaw affects EdgeSwitch units that have DHCPv6 enabled and requires no authentication or user interaction, only Layer 2/link-local reachability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.6 rating and network-daemon attack surface make it a high-priority patching target.
Heap-based buffer overflow in FreeBSD's ppp(8) daemon allows a malicious PPP peer to crash the daemon or execute arbitrary code as root. The flaw resides in mp_Enddisc(), which miscalculates buffer lengths when formatting Multilink PPP endpoint discriminator addresses, overflowing a global result buffer. Affected releases are FreeBSD 14.4-RELEASE prior to p9, 15.0-RELEASE prior to p13, and 15.1-RELEASE prior to p3; no active exploitation is confirmed (not in CISA KEV), but SSVC rates the technical impact as total and the attack as automatable.
Heap buffer overflow in Google Chrome's Media component prior to version 152.0.7977.65 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects low attack complexity and no authentication requirement, but the unchanged scope (S:U) confirms execution is sandboxed - a full system compromise would require a separate sandbox escape not described in this CVE. No public exploit code has been identified and no CISA KEV listing exists; EPSS of 0.28% (20th percentile) indicates low observed exploitation activity, which is consistent with a patch-and-monitor posture rather than emergency response.
Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 152.0.7977.65) enables a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted HTML page to a victim user. The CVSS score of 8.8 reflects broad impact (C:H/I:H/A:H) with no authentication prerequisite, though code execution is initially sandboxed and scope is unchanged (S:U). No public exploit code has been identified at time of analysis; SSVC records exploitation status as none and EPSS probability is low at 0.28% (20th percentile), suggesting this has not yet been leveraged at scale despite the high-severity rating.
Heap-based buffer overflow (CWE-122) in Blink, Chrome's rendering engine, grants native code execution within the renderer sandbox to attackers who have already achieved renderer process compromise, affecting all Chrome versions prior to 152.0.7977.65 across all platforms. The fix is confirmed in stable channel release 152.0.7977.65. No public exploit identified at time of analysis; EPSS at 0.28% (20th percentile) and Chromium's own Medium severity rating both reflect the high attack complexity imposed by the mandatory prior-renderer-compromise precondition.