Monthly
An out-of-bounds stack read in OpenWrt's odhcpd DHCPv6 server lets an unauthenticated client on the same IPv6 link disclose server stack memory, roughly four bytes per request, by placing a zero-length or otherwise truncated IA_NA/IA_PD option at the very end of the daemon's 8192-byte receive buffer; the disclosed bytes are reflected back to the sender as the IAID in odhcpd's DHCPv6 reply. Every inspected OpenWrt stable release from 17.01.0 through the 25.12.x series pins a vulnerable odhcpd commit, and the impact is confidentiality-only (assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A validated proof-of-concept reproducer, published alongside the upstream advisory, leaks the saved stack canary on ARM, but there is no CISA KEV listing and each probe returns only about four bytes, so defeating canary and ASLR protections requires many requests.
ARP/neighbor-table poisoning in the iscsiuio userspace daemon shipped with open-iscsi lets an unauthenticated attacker on the same Layer 2 segment redirect network traffic by sending a single minimal IPv6 Neighbor Advertisement. Affected deployments are those where iscsiuio is actually running for iSCSI hardware offload (typically with supported Broadcom NICs); a default server without iSCSI offload configured is not exposed. The same handler also reads link-layer address options at a fixed offset without confirming the packet carries them, an out-of-bounds read that can leak memory or crash the daemon; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in the iscsiuio DHCPv4 option parser, part of open-iscsi, allows an attacker on the same Layer-2 segment to send a crafted DHCP response that can crash the daemon, corrupt its network configuration, and potentially disclose limited heap data. Deployments at risk are those running iscsiuio for iSCSI offload, notably on Broadcom bnx2/cnic NICs, and using DHCP-driven iSCSI configuration; Red Hat tracks Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) was provided; the issue is rated moderate priority (this_week).
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame image is advanced to a later frame whose pixel mode widens from a narrow format to RGB or CMYK, or whose dimensions change, producing native out-of-bounds writes and crashes; the MPO path can additionally over-read memory and, on specific runtime/heap profiles, achieve command execution. Exploitation requires the application to open an attacker-supplied PSD, MPO, DCX, or MIC file and actually seek/load past the first frame, since reading only the initial frame does not trigger the bug; no credentials or user interaction are needed in an automated image-processing pipeline. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, although the 9.8 CVSS and the trivially craftable file format make weaponization plausible for any service that validates or thumbnails multi-frame uploads.
Heap buffer over-read in Pillow's Windows-only WMF/EMF renderer (versions prior to 13.0.0) lets a crafted wide, short metafile trigger out-of-bounds memory reads during rasterization. Pillow passes unchecked 32-bit metafile dimensions into the native drawwmf handler, which allocates a DIB using 16-bit-truncated width/height fields but then copies pixel data using the original full dimensions; because the truncated geometry keeps the total pixel count small, the image passes Pillow's decompression-bomb check while the copy still walks past the end of the heap buffer. Only Windows deployments that render attacker-supplied metafiles are exposed, and rendering must be explicitly initiated (UI:R); the practical outcome is limited disclosure of adjacent heap memory or a process crash via the enlarged read, with no public exploit identified at time of analysis and no CISA KEV listing.
Remote denial of service in NTPsec ntpd 1.1.4 through 1.2.5 lets an unauthenticated network attacker crash the daemon by sending a crafted NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, but only on instances where Network Time Security is actually configured and enabled. The out-of-bounds read terminates the process, producing a pure availability impact with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The NTS deployment prerequisite - not the default for many NTP installations - substantially bounds the exposed population, making this a genuine but limited availability risk.
Denial of service in Eclipse OpenJ9 through 0.63.0 affects deployments that enable the optional JITServer mode, where unauthenticated remote attackers or a malicious JITServer peer can crash the daemon or a client JVM with malformed protocol messages. The vendor CVSS 4.0 score is 8.7 (High), and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms remote, low-complexity, availability-only impact with no confidentiality or integrity loss. JITServer is not enabled in default JVM operation, so standard OpenJ9 installations are not exposed; no public exploit or CISA KEV entry was identified at time of analysis.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0 allows a network attacker to abort the server process by sending a crafted HPACK header block over HTTP/2 or gRPC. The h2 parser is enabled by default on bRPC server ports and processes headers before authentication, so any exposed h2/gRPC listener is at risk. No public exploit identified at time of analysis, and the impact is limited to availability (process crash).
Unauthenticated remote attackers can crash an Apache bRPC server running version 1.17.0 or earlier by sending a crafted HPACK header block that fills the decoder's dynamic-table ring buffer past its capacity, tripping an internal CHECK() assertion and aborting the process. The flaw affects any bRPC deployment that exposes an HTTP/2 or gRPC (h2) listener to an untrusted network, since HPACK decoding happens before any Authenticator check and the h2 parser is enabled by default on bRPC ports. Impact is limited to availability (process termination); no code execution or data exposure is described, and no public exploit code was identified at time of analysis. This is one of 35 fixes bundled into the bRPC 1.18.0 security release, which also addresses related h2 resource-consumption and decompression issues.
Heap-based out-of-bounds read in FreeRDP before 3.32.1 allows an attacker-controlled RDP server to disclose heap memory when a victim pastes a crafted low-bit-depth PNG clipboard payload. The client-side flaw occurs in WinPR's PNG-to-CF_DIB conversion, where a bit-packed buffer is allocated for sub-8-bit PNGs but rows are copied as one byte per pixel, and exploitation requires clipboard redirection plus user paste interaction. Impact is information disclosure only; no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds stack read in OpenWrt's odhcpd DHCPv6 server lets an unauthenticated client on the same IPv6 link disclose server stack memory, roughly four bytes per request, by placing a zero-length or otherwise truncated IA_NA/IA_PD option at the very end of the daemon's 8192-byte receive buffer; the disclosed bytes are reflected back to the sender as the IAID in odhcpd's DHCPv6 reply. Every inspected OpenWrt stable release from 17.01.0 through the 25.12.x series pins a vulnerable odhcpd commit, and the impact is confidentiality-only (assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A validated proof-of-concept reproducer, published alongside the upstream advisory, leaks the saved stack canary on ARM, but there is no CISA KEV listing and each probe returns only about four bytes, so defeating canary and ASLR protections requires many requests.
ARP/neighbor-table poisoning in the iscsiuio userspace daemon shipped with open-iscsi lets an unauthenticated attacker on the same Layer 2 segment redirect network traffic by sending a single minimal IPv6 Neighbor Advertisement. Affected deployments are those where iscsiuio is actually running for iSCSI hardware offload (typically with supported Broadcom NICs); a default server without iSCSI offload configured is not exposed. The same handler also reads link-layer address options at a fixed offset without confirming the packet carries them, an out-of-bounds read that can leak memory or crash the daemon; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in the iscsiuio DHCPv4 option parser, part of open-iscsi, allows an attacker on the same Layer-2 segment to send a crafted DHCP response that can crash the daemon, corrupt its network configuration, and potentially disclose limited heap data. Deployments at risk are those running iscsiuio for iSCSI offload, notably on Broadcom bnx2/cnic NICs, and using DHCP-driven iSCSI configuration; Red Hat tracks Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) was provided; the issue is rated moderate priority (this_week).
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame image is advanced to a later frame whose pixel mode widens from a narrow format to RGB or CMYK, or whose dimensions change, producing native out-of-bounds writes and crashes; the MPO path can additionally over-read memory and, on specific runtime/heap profiles, achieve command execution. Exploitation requires the application to open an attacker-supplied PSD, MPO, DCX, or MIC file and actually seek/load past the first frame, since reading only the initial frame does not trigger the bug; no credentials or user interaction are needed in an automated image-processing pipeline. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, although the 9.8 CVSS and the trivially craftable file format make weaponization plausible for any service that validates or thumbnails multi-frame uploads.
Heap buffer over-read in Pillow's Windows-only WMF/EMF renderer (versions prior to 13.0.0) lets a crafted wide, short metafile trigger out-of-bounds memory reads during rasterization. Pillow passes unchecked 32-bit metafile dimensions into the native drawwmf handler, which allocates a DIB using 16-bit-truncated width/height fields but then copies pixel data using the original full dimensions; because the truncated geometry keeps the total pixel count small, the image passes Pillow's decompression-bomb check while the copy still walks past the end of the heap buffer. Only Windows deployments that render attacker-supplied metafiles are exposed, and rendering must be explicitly initiated (UI:R); the practical outcome is limited disclosure of adjacent heap memory or a process crash via the enlarged read, with no public exploit identified at time of analysis and no CISA KEV listing.
Remote denial of service in NTPsec ntpd 1.1.4 through 1.2.5 lets an unauthenticated network attacker crash the daemon by sending a crafted NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, but only on instances where Network Time Security is actually configured and enabled. The out-of-bounds read terminates the process, producing a pure availability impact with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The NTS deployment prerequisite - not the default for many NTP installations - substantially bounds the exposed population, making this a genuine but limited availability risk.
Denial of service in Eclipse OpenJ9 through 0.63.0 affects deployments that enable the optional JITServer mode, where unauthenticated remote attackers or a malicious JITServer peer can crash the daemon or a client JVM with malformed protocol messages. The vendor CVSS 4.0 score is 8.7 (High), and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms remote, low-complexity, availability-only impact with no confidentiality or integrity loss. JITServer is not enabled in default JVM operation, so standard OpenJ9 installations are not exposed; no public exploit or CISA KEV entry was identified at time of analysis.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0 allows a network attacker to abort the server process by sending a crafted HPACK header block over HTTP/2 or gRPC. The h2 parser is enabled by default on bRPC server ports and processes headers before authentication, so any exposed h2/gRPC listener is at risk. No public exploit identified at time of analysis, and the impact is limited to availability (process crash).
Unauthenticated remote attackers can crash an Apache bRPC server running version 1.17.0 or earlier by sending a crafted HPACK header block that fills the decoder's dynamic-table ring buffer past its capacity, tripping an internal CHECK() assertion and aborting the process. The flaw affects any bRPC deployment that exposes an HTTP/2 or gRPC (h2) listener to an untrusted network, since HPACK decoding happens before any Authenticator check and the h2 parser is enabled by default on bRPC ports. Impact is limited to availability (process termination); no code execution or data exposure is described, and no public exploit code was identified at time of analysis. This is one of 35 fixes bundled into the bRPC 1.18.0 security release, which also addresses related h2 resource-consumption and decompression issues.
Heap-based out-of-bounds read in FreeRDP before 3.32.1 allows an attacker-controlled RDP server to disclose heap memory when a victim pastes a crafted low-bit-depth PNG clipboard payload. The client-side flaw occurs in WinPR's PNG-to-CF_DIB conversion, where a bit-packed buffer is allocated for sub-8-bit PNGs but rows are copied as one byte per pixel, and exploitation requires clipboard redirection plus user paste interaction. Impact is information disclosure only; no public exploit code or confirmed active exploitation was identified at time of analysis.