Monthly
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rclone-exposed storage to crash the rclone process or exhaust CPU. Affected versions v1.72.0 through v1.74.4 fail to validate attacker-controlled superblock and inode metadata values sourced from the go-diskfs dependency before use, enabling three distinct panic/loop conditions. When the :archive: remote is exposed via 'rclone serve sftp', exploitation crashes the entire SFTP server. No public exploit has been identified at time of analysis, but the attack surface is concrete and parser triggering is straightforward once a malicious image is placed.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. No public exploit identified at time of analysis; IBM has released a patch via its support portal.
Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.
Out-of-bounds heap write in the Linux kernel iforce force-feedback input driver allows a physically connected malicious device to corrupt kernel memory. The iforce driver's status packet handler blindly uses a device-supplied effect index masked only to 0-127 as an array subscript into a 32-entry array, enabling `test_and_set_bit`/`test_and_clear_bit` operations up to 95 entries past the array boundary and into trailing kzalloc'd structure members. No confirmed active exploitation exists (not in CISA KEV), and EPSS probability is very low at 0.22% (13th percentile), but successful exploitation against an unpatched kernel yields high confidentiality, integrity, and availability impact at the kernel heap level.
Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rclone-exposed storage to crash the rclone process or exhaust CPU. Affected versions v1.72.0 through v1.74.4 fail to validate attacker-controlled superblock and inode metadata values sourced from the go-diskfs dependency before use, enabling three distinct panic/loop conditions. When the :archive: remote is exposed via 'rclone serve sftp', exploitation crashes the entire SFTP server. No public exploit has been identified at time of analysis, but the attack surface is concrete and parser triggering is straightforward once a malicious image is placed.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. No public exploit identified at time of analysis; IBM has released a patch via its support portal.
Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.
Out-of-bounds heap write in the Linux kernel iforce force-feedback input driver allows a physically connected malicious device to corrupt kernel memory. The iforce driver's status packet handler blindly uses a device-supplied effect index masked only to 0-127 as an array subscript into a 32-entry array, enabling `test_and_set_bit`/`test_and_clear_bit` operations up to 95 entries past the array boundary and into trailing kzalloc'd structure members. No confirmed active exploitation exists (not in CISA KEV), and EPSS probability is very low at 0.22% (13th percentile), but successful exploitation against an unpatched kernel yields high confidentiality, integrity, and availability impact at the kernel heap level.
Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.