Monthly
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Sandbox-escaping remote code execution in Google Chrome before 153.0.8010.36 stems from improper array-index validation (CWE-129) in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; no public exploit is identified at time of analysis and EPSS is low (0.21%).
Server process termination in gRPC-Go's xDS routing layer allows any network-reachable attacker to crash a server instantiated with `xds.NewGRPCServer()` by sending a single crafted HTTP/2 request. The vulnerability stems from the xDS routing interceptor unconditionally reading index 0 of the authority slice before checking whether the slice is empty - triggered when both `:authority` and `Host` headers are absent from an otherwise valid HTTP/2 stream. Because the per-RPC goroutine provides no panic recovery, the unhandled Go runtime panic terminates the entire server process; vendor-released patches v1.82.2 and v1.83.2 address this by rejecting such requests at the transport layer before they reach the interceptor.
Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low privileges to craft a filter program that reads or writes OS process memory beyond the intended 16-entry M[] scratch array. On 64-bit architectures the accessible range is up to 16GiB starting at the current stack frame; on 32-bit architectures the entire process address space is reachable. The Tcpdump Group has issued a fix (commit 48e8960a) that adds bounds checks before every M[] access, rejecting filters referencing register index ≥ BPF_MEMWORDS (16). No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rclone-exposed storage to crash the rclone process or exhaust CPU. Affected versions v1.72.0 through v1.74.4 fail to validate attacker-controlled superblock and inode metadata values sourced from the go-diskfs dependency before use, enabling three distinct panic/loop conditions. When the :archive: remote is exposed via 'rclone serve sftp', exploitation crashes the entire SFTP server. No public exploit has been identified at time of analysis, but the attack surface is concrete and parser triggering is straightforward once a malicious image is placed.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.
Out-of-bounds array read in the Linux kernel's USB Type-C Port Manager (TCPM) svdm_consume_modes() function allows a physically connected malicious USB-C partner device to read kernel memory beyond the svids[] array boundary and force registration of an arbitrary, attacker-chosen SVID via typec_partner_register_altmode(). The vulnerability arises because pmdata->svid_index - which is incremented in response to partner-supplied SVDM messages - is never validated against SVID_DISCOVERY_MAX (16) before indexing pmdata->svids[]. Patches are confirmed available across eight stable kernel branches (5.10 through 7.2-rc3); no public exploit or CISA KEV listing exists at time of analysis.
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Sandbox-escaping remote code execution in Google Chrome before 153.0.8010.36 stems from improper array-index validation (CWE-129) in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; no public exploit is identified at time of analysis and EPSS is low (0.21%).
Server process termination in gRPC-Go's xDS routing layer allows any network-reachable attacker to crash a server instantiated with `xds.NewGRPCServer()` by sending a single crafted HTTP/2 request. The vulnerability stems from the xDS routing interceptor unconditionally reading index 0 of the authority slice before checking whether the slice is empty - triggered when both `:authority` and `Host` headers are absent from an otherwise valid HTTP/2 stream. Because the per-RPC goroutine provides no panic recovery, the unhandled Go runtime panic terminates the entire server process; vendor-released patches v1.82.2 and v1.83.2 address this by rejecting such requests at the transport layer before they reach the interceptor.
Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low privileges to craft a filter program that reads or writes OS process memory beyond the intended 16-entry M[] scratch array. On 64-bit architectures the accessible range is up to 16GiB starting at the current stack frame; on 32-bit architectures the entire process address space is reachable. The Tcpdump Group has issued a fix (commit 48e8960a) that adds bounds checks before every M[] access, rejecting filters referencing register index ≥ BPF_MEMWORDS (16). No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rclone-exposed storage to crash the rclone process or exhaust CPU. Affected versions v1.72.0 through v1.74.4 fail to validate attacker-controlled superblock and inode metadata values sourced from the go-diskfs dependency before use, enabling three distinct panic/loop conditions. When the :archive: remote is exposed via 'rclone serve sftp', exploitation crashes the entire SFTP server. No public exploit has been identified at time of analysis, but the attack surface is concrete and parser triggering is straightforward once a malicious image is placed.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.
Out-of-bounds array read in the Linux kernel's USB Type-C Port Manager (TCPM) svdm_consume_modes() function allows a physically connected malicious USB-C partner device to read kernel memory beyond the svids[] array boundary and force registration of an arbitrary, attacker-chosen SVID via typec_partner_register_altmode(). The vulnerability arises because pmdata->svid_index - which is incremented in response to partner-supplied SVDM messages - is never validated against SVID_DISCOVERY_MAX (16) before indexing pmdata->svids[]. Patches are confirmed available across eight stable kernel branches (5.10 through 7.2-rc3); no public exploit or CISA KEV listing exists at time of analysis.