CWE-1285
Improper Validation of Specified Index, Position, or Offset in Input
Monthly
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's APU (AI Processing Unit) allows a locally-executing attacker to corrupt memory via malformed input, potentially achieving kernel-level code execution on devices with affected chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668). The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already run code on the device, such as a malicious Android app, with no additional privileges or user interaction needed. No public exploit identified at time of analysis, and the flaw is fixed by MediaTek patch ALPS11249004.
Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to SYSTEM-level and execute arbitrary code, as confirmed by the NI vendor advisory. Affected deployments include NI-PAL versions 26.3.1 and all prior releases running exclusively on Microsoft Windows. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, but the low access complexity (AC:L, AT:N in CVSS 4.0) means exploitation requires no special conditions beyond a local user session.
Trusted measurement-list poisoning in Google go-attestation through 0.6.0 lets a remote actor who controls a TPM event log fed to an attestation verifier inject arbitrary SHA256 hashes into the verifier's trusted hash database. Because parseEfiSignatureList() never advances past the EFI_SIGNATURE_LIST SignatureHeaderSize vendor bytes, those attacker-chosen bytes are accepted as legitimate hash entries, allowing a compromised boot state to be attested as healthy. No public exploit identified at time of analysis, but the fix is upstream in v0.6.1 and the root cause is documented in GHSA-9r4w-jg96-92mv.
Local privilege escalation in National Instruments NI-PAL versions 26.3.0 and earlier on Windows and Linux allows authenticated low-privileged users to read arbitrary system memory through improper input validation, potentially leading to full privilege escalation. CVSS 4.0 base score is 8.4 (High) reflecting the local attack vector but high confidentiality and integrity impact. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Apache Kafka 4.1.0 and 4.1.1 accept forged JWT tokens without signature validation, allowing remote unauthenticated attackers to authenticate as any user and gain unauthorized access to Kafka resources. The default SASL/OAUTHBEARER validator (DefaultJwtValidator) fails to verify token signatures, issuers, or audiences, enabling complete authentication bypass. CVSS 9.1 (Critical) with network vector and no privileges required. SSVC indicates the vulnerability is automatable with partial technical impact. No active exploitation confirmed at time of analysis, but the attack requires minimal sophistication and could be scripted trivially given the token acceptance behavior.
Improper boundary validation of metadata slot values in luksmeta allows an attacker who can supply or modify a LUKS disk header to redirect wipe or load operations outside the intended metadata area, overwriting or zeroing encrypted payload data and causing persistent data loss and corrupted storage. The attack is confined to a local vector and requires high privileges - root-level write access to the raw block device, or inducing an administrator to process an attacker-supplied untrusted disk image whose header carries out-of-range slot values together with valid checksums. The impact is limited to integrity and availability, with no information disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the moderate CVSS of 6.0 reflects the substantial privilege barrier rather than the severity of the data-loss outcome.
Out-of-bounds read in Godot Engine through 4.7.2 lets a crafted .translation resource drive a hash-table offset far past the allocated bucket table in OptimizedTranslation::get_message, so that loading the resource and performing a tr() string lookup either crashes the Godot editor or an exported game or returns raw heap bytes from elsewhere in the process as the 'translated' string, disclosing process memory. Exploitation is local and requires user interaction - the crafted translation file must be delivered into the project or game and then a lookup performed against it - and reliable heap disclosure depends heavily on process memory layout, so a crash is far easier to trigger than a useful leak; there is no public exploit identified at time of analysis. The report is disputed by the supplier, which argues loading untrusted resource files sits outside Godot's current threat model, and the assessed CVSS of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) reflects a genuinely low real-world risk rather than a remote or wormable issue.
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter program to drive the interpreter's program counter past the end of the filter buffer, reading up to 32 GiB of surrounding process memory on 64-bit systems or the entire address space on 32-bit systems. All libpcap versions tracked under CPE cpe:2.3:a:the_tcpdump_group:libpcap are affected; The Tcpdump Group has published a fix via commit d3f358d3. No active exploitation has been confirmed and no public exploit exists; the vulnerability is restricted to uncommon application patterns that pass raw BPF bytecode directly to the interpreter without prior validation.
The Autodesk Installer IPC frame parser fails to properly validate attacker-controlled position and offset fields (CWE-1285), allowing a locally authenticated low-privileged user to trigger an out-of-range substring operation that crashes the NT AUTHORITY\SYSTEM service. Affected scope covers all tracked versions per the wildcard CPE string, and Autodesk has confirmed and patched the issue via advisory ADSK-SA-2026-0013. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Local privilege escalation in MediaTek's APU (AI Processing Unit) allows a locally-executing attacker to corrupt memory via malformed input, potentially achieving kernel-level code execution on devices with affected chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668). The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already run code on the device, such as a malicious Android app, with no additional privileges or user interaction needed. No public exploit identified at time of analysis, and the flaw is fixed by MediaTek patch ALPS11249004.
Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to SYSTEM-level and execute arbitrary code, as confirmed by the NI vendor advisory. Affected deployments include NI-PAL versions 26.3.1 and all prior releases running exclusively on Microsoft Windows. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, but the low access complexity (AC:L, AT:N in CVSS 4.0) means exploitation requires no special conditions beyond a local user session.
Trusted measurement-list poisoning in Google go-attestation through 0.6.0 lets a remote actor who controls a TPM event log fed to an attestation verifier inject arbitrary SHA256 hashes into the verifier's trusted hash database. Because parseEfiSignatureList() never advances past the EFI_SIGNATURE_LIST SignatureHeaderSize vendor bytes, those attacker-chosen bytes are accepted as legitimate hash entries, allowing a compromised boot state to be attested as healthy. No public exploit identified at time of analysis, but the fix is upstream in v0.6.1 and the root cause is documented in GHSA-9r4w-jg96-92mv.
Local privilege escalation in National Instruments NI-PAL versions 26.3.0 and earlier on Windows and Linux allows authenticated low-privileged users to read arbitrary system memory through improper input validation, potentially leading to full privilege escalation. CVSS 4.0 base score is 8.4 (High) reflecting the local attack vector but high confidentiality and integrity impact. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Apache Kafka 4.1.0 and 4.1.1 accept forged JWT tokens without signature validation, allowing remote unauthenticated attackers to authenticate as any user and gain unauthorized access to Kafka resources. The default SASL/OAUTHBEARER validator (DefaultJwtValidator) fails to verify token signatures, issuers, or audiences, enabling complete authentication bypass. CVSS 9.1 (Critical) with network vector and no privileges required. SSVC indicates the vulnerability is automatable with partial technical impact. No active exploitation confirmed at time of analysis, but the attack requires minimal sophistication and could be scripted trivially given the token acceptance behavior.
Improper boundary validation of metadata slot values in luksmeta allows an attacker who can supply or modify a LUKS disk header to redirect wipe or load operations outside the intended metadata area, overwriting or zeroing encrypted payload data and causing persistent data loss and corrupted storage. The attack is confined to a local vector and requires high privileges - root-level write access to the raw block device, or inducing an administrator to process an attacker-supplied untrusted disk image whose header carries out-of-range slot values together with valid checksums. The impact is limited to integrity and availability, with no information disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the moderate CVSS of 6.0 reflects the substantial privilege barrier rather than the severity of the data-loss outcome.
Out-of-bounds read in Godot Engine through 4.7.2 lets a crafted .translation resource drive a hash-table offset far past the allocated bucket table in OptimizedTranslation::get_message, so that loading the resource and performing a tr() string lookup either crashes the Godot editor or an exported game or returns raw heap bytes from elsewhere in the process as the 'translated' string, disclosing process memory. Exploitation is local and requires user interaction - the crafted translation file must be delivered into the project or game and then a lookup performed against it - and reliable heap disclosure depends heavily on process memory layout, so a crash is far easier to trigger than a useful leak; there is no public exploit identified at time of analysis. The report is disputed by the supplier, which argues loading untrusted resource files sits outside Godot's current threat model, and the assessed CVSS of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) reflects a genuinely low real-world risk rather than a remote or wormable issue.
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter program to drive the interpreter's program counter past the end of the filter buffer, reading up to 32 GiB of surrounding process memory on 64-bit systems or the entire address space on 32-bit systems. All libpcap versions tracked under CPE cpe:2.3:a:the_tcpdump_group:libpcap are affected; The Tcpdump Group has published a fix via commit d3f358d3. No active exploitation has been confirmed and no public exploit exists; the vulnerability is restricted to uncommon application patterns that pass raw BPF bytecode directly to the interpreter without prior validation.
The Autodesk Installer IPC frame parser fails to properly validate attacker-controlled position and offset fields (CWE-1285), allowing a locally authenticated low-privileged user to trigger an out-of-range substring operation that crashes the NT AUTHORITY\SYSTEM service. Affected scope covers all tracked versions per the wildcard CPE string, and Autodesk has confirmed and patched the issue via advisory ADSK-SA-2026-0013. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.