Monthly
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine if the user opens a specially crafted spreadsheet that triggers a buffer underwrite (CWE-124) in Excel's file-parsing path. The flaw carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is fully remote with no privileges required, but the mandatory user interaction (UI:R) is the key limiting factor - the attack cannot fire unless the malicious workbook is opened, so Protected View, Mark-of-the-Web enforcement and user awareness materially reduce real-world exposure. Affected software covers Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021 on Windows and Mac, and Office Online Server; vendor patches are available per Microsoft's advisory, and no public exploit was identified at time of analysis. By signal convergence this is a genuine high-priority vulnerability, but with no confirmed active exploitation and an interaction prerequisite it is not an emergency.
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service, producing a denial-of-service condition on affected appliances. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the flaw is reachable over the network with no privileges or user interaction required, and impact is confined to availability (C:N/I:N/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Apache HTTP Server 2.4.0-2.4.67 has a buffer underwrite (CWE-124) in ap_regname, triggered by a crafted regular expression in the server configuration. The vendor (Apache) rates this Low severity. A separate CISA-ADP assessment assigned CVSS 9.8 using a network, unauthenticated vector that is inconsistent with the vendor description, because exploitation requires control over the httpd configuration. No public exploit and not in CISA KEV. Fixed in 2.4.68.
Buffer underflow in vorbis-tools 1.4.3's ogg123 utility allows remote attackers to crash the application or potentially execute code through malformed remote control input. The vulnerability achieves an EPSS score indicating moderate exploitation likelihood, with proof-of-concept code available according to SSVC assessment, though it has not been added to CISA's KEV catalog indicating no confirmed active exploitation.
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Heap buffer underwrite in ImageMagick's PICT decoder (coders/pict.c) on 32-bit builds allows unauthenticated remote attackers to corrupt memory below the allocated buffer by supplying a crafted PICT file with maximized row, column, and bytes-per-line values, potentially causing a crash or code execution. Affected versions are ImageMagick before 7.1.2-33 (7.x) and before 6.9.13-58 (6.x) when compiled as 32-bit; 64-bit builds are not affected. No public exploit code has been identified at the time of analysis, and the CVSS v4.0 score is 6.3 (moderate) with high attack complexity per the assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.
Out-of-bounds read and conditional write in Vim 9.2.0469 through 9.2.0842 can be triggered when a text-property-anchored popup window is configured with both clipwindow and opacity settings active. The defect in `popup_mark_opacity_zindex()` (src/popupwin.c) fails to account for `w_popup_topoff` when `w_winrow` is negative, causing the function to index before the start of the screen array - a classic buffer underwrite (CWE-124). Real-world impact is constrained by the local attack vector, mandatory user interaction, and non-default feature combination required; no public exploit or active exploitation has been identified at time of analysis.
Buffer underflow (CWE-124) in Eclipse OpenJ9 versions through 0.60 allows memory corruption via the JVM method argument tracing subsystem when the -Xtrace diagnostic flag is active, with potential high integrity and availability impact to the running JVM process. The defect resides in traceMethodArguments() within the trace runtime, where the cursor pointer could be decremented past the start of the allocated trace buffer when constructing an ellipsis truncation marker - a classic buffer underwrite. No active exploitation is confirmed in CISA KEV, and no public exploit code has been disclosed at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine if the user opens a specially crafted spreadsheet that triggers a buffer underwrite (CWE-124) in Excel's file-parsing path. The flaw carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is fully remote with no privileges required, but the mandatory user interaction (UI:R) is the key limiting factor - the attack cannot fire unless the malicious workbook is opened, so Protected View, Mark-of-the-Web enforcement and user awareness materially reduce real-world exposure. Affected software covers Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021 on Windows and Mac, and Office Online Server; vendor patches are available per Microsoft's advisory, and no public exploit was identified at time of analysis. By signal convergence this is a genuine high-priority vulnerability, but with no confirmed active exploitation and an interaction prerequisite it is not an emergency.
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service, producing a denial-of-service condition on affected appliances. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the flaw is reachable over the network with no privileges or user interaction required, and impact is confined to availability (C:N/I:N/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Apache HTTP Server 2.4.0-2.4.67 has a buffer underwrite (CWE-124) in ap_regname, triggered by a crafted regular expression in the server configuration. The vendor (Apache) rates this Low severity. A separate CISA-ADP assessment assigned CVSS 9.8 using a network, unauthenticated vector that is inconsistent with the vendor description, because exploitation requires control over the httpd configuration. No public exploit and not in CISA KEV. Fixed in 2.4.68.
Buffer underflow in vorbis-tools 1.4.3's ogg123 utility allows remote attackers to crash the application or potentially execute code through malformed remote control input. The vulnerability achieves an EPSS score indicating moderate exploitation likelihood, with proof-of-concept code available according to SSVC assessment, though it has not been added to CISA's KEV catalog indicating no confirmed active exploitation.
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Heap buffer underwrite in ImageMagick's PICT decoder (coders/pict.c) on 32-bit builds allows unauthenticated remote attackers to corrupt memory below the allocated buffer by supplying a crafted PICT file with maximized row, column, and bytes-per-line values, potentially causing a crash or code execution. Affected versions are ImageMagick before 7.1.2-33 (7.x) and before 6.9.13-58 (6.x) when compiled as 32-bit; 64-bit builds are not affected. No public exploit code has been identified at the time of analysis, and the CVSS v4.0 score is 6.3 (moderate) with high attack complexity per the assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.
Out-of-bounds read and conditional write in Vim 9.2.0469 through 9.2.0842 can be triggered when a text-property-anchored popup window is configured with both clipwindow and opacity settings active. The defect in `popup_mark_opacity_zindex()` (src/popupwin.c) fails to account for `w_popup_topoff` when `w_winrow` is negative, causing the function to index before the start of the screen array - a classic buffer underwrite (CWE-124). Real-world impact is constrained by the local attack vector, mandatory user interaction, and non-default feature combination required; no public exploit or active exploitation has been identified at time of analysis.
Buffer underflow (CWE-124) in Eclipse OpenJ9 versions through 0.60 allows memory corruption via the JVM method argument tracing subsystem when the -Xtrace diagnostic flag is active, with potential high integrity and availability impact to the running JVM process. The defect resides in traceMethodArguments() within the trace runtime, where the cursor pointer could be decremented past the start of the allocated trace buffer when constructing an ellipsis truncation marker - a classic buffer underwrite. No active exploitation is confirmed in CISA KEV, and no public exploit code has been disclosed at time of analysis.