Monthly
Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.
Out-of-bounds read and conditional write in Vim 9.2.0469 through 9.2.0842 can be triggered when a text-property-anchored popup window is configured with both clipwindow and opacity settings active. The defect in `popup_mark_opacity_zindex()` (src/popupwin.c) fails to account for `w_popup_topoff` when `w_winrow` is negative, causing the function to index before the start of the screen array - a classic buffer underwrite (CWE-124). Real-world impact is constrained by the local attack vector, mandatory user interaction, and non-default feature combination required; no public exploit or active exploitation has been identified at time of analysis.
Buffer underflow (CWE-124) in Eclipse OpenJ9 versions through 0.60 allows memory corruption via the JVM method argument tracing subsystem when the -Xtrace diagnostic flag is active, with potential high integrity and availability impact to the running JVM process. The defect resides in traceMethodArguments() within the trace runtime, where the cursor pointer could be decremented past the start of the allocated trace buffer when constructing an ellipsis truncation marker - a classic buffer underwrite. No active exploitation is confirmed in CISA KEV, and no public exploit code has been disclosed at time of analysis.
Buffer underflow in HDF5 library versions through 1.14.6 corrupts memory when H5Iget_name is called with a size parameter of zero on a group identifier, writing a null terminator before the intended buffer boundary and potentially crashing the host application. Applications that ingest attacker-supplied HDF5 files and expose user-controlled size values to H5Iget_name face availability disruption and, under specific heap layouts, possible disclosure of adjacent memory contents. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.9 reflects the high attack complexity and required active user interaction that meaningfully constrain real-world exploitation.
Apache HTTP Server 2.4.0-2.4.67 has a buffer underwrite (CWE-124) in ap_regname, triggered by a crafted regular expression in the server configuration. The vendor (Apache) rates this Low severity. A separate CISA-ADP assessment assigned CVSS 9.8 using a network, unauthenticated vector that is inconsistent with the vendor description, because exploitation requires control over the httpd configuration. No public exploit and not in CISA KEV. Fixed in 2.4.68.
Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
Buffer underflow in vorbis-tools 1.4.3's ogg123 utility allows remote attackers to crash the application or potentially execute code through malformed remote control input. The vulnerability achieves an EPSS score indicating moderate exploitation likelihood, with proof-of-concept code available according to SSVC assessment, though it has not been added to CISA's KEV catalog indicating no confirmed active exploitation.
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
Heap buffer underwrite vulnerabilities in Wazuh Manager's remoted component allow an authenticated agent to corrupt the manager process heap, causing denial of service and potential code execution. Wazuh versions 4.0.0 through 4.14.3 are affected across all platforms where the manager role is deployed. A public proof-of-concept exists per SSVC data, though EPSS remains very low at 0.04% (12th percentile) and the vulnerability has not been confirmed as actively exploited in CISA KEV, suggesting exploitation is feasible but has not yet reached widespread use.
Heap-based buffer underwrite in Wazuh's GetAlertData function (versions 1.0.0 through 4.14.3) allows a threat actor who has already compromised a Wazuh agent to corrupt heap metadata on the manager or agent host by injecting a specially crafted alert into the log file monitored by wazuh-logcollector. The root cause is an unsigned integer underflow combined with pointer arithmetic wrapping that causes a NULL byte write exactly one byte before the start of a strdup-allocated buffer, corrupting adjacent heap metadata. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies a POC as existing; EPSS at 0.01% (2nd percentile) reflects very low observed exploitation probability, and a vendor-released patch is available in version 4.14.4.
Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.
Out-of-bounds read and conditional write in Vim 9.2.0469 through 9.2.0842 can be triggered when a text-property-anchored popup window is configured with both clipwindow and opacity settings active. The defect in `popup_mark_opacity_zindex()` (src/popupwin.c) fails to account for `w_popup_topoff` when `w_winrow` is negative, causing the function to index before the start of the screen array - a classic buffer underwrite (CWE-124). Real-world impact is constrained by the local attack vector, mandatory user interaction, and non-default feature combination required; no public exploit or active exploitation has been identified at time of analysis.
Buffer underflow (CWE-124) in Eclipse OpenJ9 versions through 0.60 allows memory corruption via the JVM method argument tracing subsystem when the -Xtrace diagnostic flag is active, with potential high integrity and availability impact to the running JVM process. The defect resides in traceMethodArguments() within the trace runtime, where the cursor pointer could be decremented past the start of the allocated trace buffer when constructing an ellipsis truncation marker - a classic buffer underwrite. No active exploitation is confirmed in CISA KEV, and no public exploit code has been disclosed at time of analysis.
Buffer underflow in HDF5 library versions through 1.14.6 corrupts memory when H5Iget_name is called with a size parameter of zero on a group identifier, writing a null terminator before the intended buffer boundary and potentially crashing the host application. Applications that ingest attacker-supplied HDF5 files and expose user-controlled size values to H5Iget_name face availability disruption and, under specific heap layouts, possible disclosure of adjacent memory contents. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.9 reflects the high attack complexity and required active user interaction that meaningfully constrain real-world exploitation.
Apache HTTP Server 2.4.0-2.4.67 has a buffer underwrite (CWE-124) in ap_regname, triggered by a crafted regular expression in the server configuration. The vendor (Apache) rates this Low severity. A separate CISA-ADP assessment assigned CVSS 9.8 using a network, unauthenticated vector that is inconsistent with the vendor description, because exploitation requires control over the httpd configuration. No public exploit and not in CISA KEV. Fixed in 2.4.68.
Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
Buffer underflow in vorbis-tools 1.4.3's ogg123 utility allows remote attackers to crash the application or potentially execute code through malformed remote control input. The vulnerability achieves an EPSS score indicating moderate exploitation likelihood, with proof-of-concept code available according to SSVC assessment, though it has not been added to CISA's KEV catalog indicating no confirmed active exploitation.
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
Heap buffer underwrite vulnerabilities in Wazuh Manager's remoted component allow an authenticated agent to corrupt the manager process heap, causing denial of service and potential code execution. Wazuh versions 4.0.0 through 4.14.3 are affected across all platforms where the manager role is deployed. A public proof-of-concept exists per SSVC data, though EPSS remains very low at 0.04% (12th percentile) and the vulnerability has not been confirmed as actively exploited in CISA KEV, suggesting exploitation is feasible but has not yet reached widespread use.
Heap-based buffer underwrite in Wazuh's GetAlertData function (versions 1.0.0 through 4.14.3) allows a threat actor who has already compromised a Wazuh agent to corrupt heap metadata on the manager or agent host by injecting a specially crafted alert into the log file monitored by wazuh-logcollector. The root cause is an unsigned integer underflow combined with pointer arithmetic wrapping that causes a NULL byte write exactly one byte before the start of a strdup-allocated buffer, corrupting adjacent heap metadata. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies a POC as existing; EPSS at 0.01% (2nd percentile) reflects very low observed exploitation probability, and a vendor-released patch is available in version 4.14.4.