Monthly
Malformed BGP labeled-unicast UPDATE messages can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on affected routers (CVSS 8.7). Per the vendor CVSS vector the attack is unauthenticated (PR:N), but exploitation in practice requires two concrete preconditions: the sender must be a configured eBGP neighbor with an established BGP peering session to the target, and the affected BGP multipath features must be enabled on the router, with the trigger arriving as labeled-unicast UPDATEs. Impact is availability only - rpd crashes with no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, so this is primarily an operational-availability risk for Juniper networks that peer eBGP with external or less-trusted parties and run multipath.
A double-offset error in DPDK's vhost log-mapping calculation (lib/vhost) lets local attackers with low privileges (PR:L) - including a guest that controls a virtio device serviced by the vulnerable vhost-user backend - trigger incorrect host memory accesses that compromise confidentiality, integrity and availability, giving a 7.8 HIGH rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is tracked by Red Hat and ships in Fast Datapath for RHEL 8, 9 and 10, which in turn is consumed by Red Hat Enterprise Linux 8/9/10, OpenShift Container Platform 4 and OpenStack Platform 13 (Queens), so exposure is concentrated in OVS-DPDK accelerated virtualization and NFV hosts that exercise the vhost log-mapping path (for example during guest dirty-page logging/live migration). No public exploit identified at time of analysis, and no CISA KEV listing or exploit code is referenced in the available intelligence.
Incorrect buffer size calculation in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows allows a local attacker who already holds low-privileged code execution on the host to escalate to kernel-level privileges, with downstream risk of code execution, denial of service, information disclosure, and data tampering. The flaw affects GeForce, RTX/Quadro/NVS, Tesla data-center, and vGPU/Virtual GPU Manager drivers, and rates CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N) - it is strictly local, not remotely triggerable, so exposure is limited to shared workstations, multi-tenant vGPU/VDI environments, and cloud-GPU nodes where an untrusted party can already run code. No public exploit code or confirmed active exploitation was identified at time of analysis.
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpga FPGA SoCs lets a locally-positioned attacker who already holds high privileges corrupt firmware memory through an incorrectly calculated buffer size. All Trusted Firmware releases up to and including the socfpga_v2.14.0 branch are affected, and exploitation requires local access combined with high-privileged normal-world code execution capable of reaching the firmware's service interface - the flaw is not remotely reachable and cannot be triggered by an unprivileged user. There is no confirmed active exploitation and no public exploit identified at time of analysis; the assessed risk is primarily post-compromise privilege and trust escalation on the specific embedded hardware, with real-world exposure constrained by the local, high-privilege prerequisite.
Incorrect buffer size arithmetic in tinyexpr's new_expr() causes an undersized heap allocation for every arity-0 expression node (constants, variables, and zero-argument functions), which the parser then uses as a complete te_expr object. Because tinyexpr is a parsing library with no network surface of its own, exploitation requires a host application that feeds attacker-influenced expression strings to te_compile(), and the visible failure (deterministic process termination) is primarily observed in UBSan-instrumented development or CI builds rather than standard production builds. The binary-unauthenticated CVSS 3.1 score of 7.5 reflects a worst-case A:H impact, but our assessment downgrades availability to Low (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L) because plain release builds exhibit undefined behavior without a guaranteed crash; EPSS is 0.15% (4th percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis. An upstream fix commit is available.
Pre-authentication heap memory corruption in BusyBox's built-in TLS implementation can be triggered by a remote, unauthenticated attacker who sends a single crafted ClientKeyExchange handshake message to a BusyBox process acting as a TLS server, corrupting the heap and crashing the process (CVSS 3.1 base 7.5, availability-only with no confidentiality or integrity impact rated). Exploitation requires a BusyBox binary compiled with TLS support and reachable in a server role, a deployment pattern that is the exception rather than the norm since BusyBox TLS is most often used outbound (for example by wget https), which sharply narrows the realistically exposed population. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence; the issue is tracked by Red Hat via its CVE page and Bugzilla, with no public exploit identified at time of analysis.
Loading a crafted legacy X10 'static short' XBM image with SAIL versions prior to 1.0.0 triggers a forward heap buffer overflow in sail_codec_load_frame_v8_xbm() that lets a file-controlled write corrupt process state, reliably crash the consuming application, and potentially achieve code execution depending on the host's memory layout and mitigations. The flaw is reachable through sail_load_from_file, sail_load_from_memory, and sail_start_loading_*, but only when the destination image has an odd row stride (ceil(width/8) odd) and only on the X10 short path - the X11 'static char' path is explicitly unaffected. Exploitation is local and file-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) and requires the victim to open the malicious image; no public exploit code or confirmed active exploitation was identified at time of analysis, and the impact scales with image height.
Memory corruption in ArduinoBLE's ATT layer write request handler allows an unauthenticated BLE client within Bluetooth range to overflow the ATTClass global object's write buffer by sending a crafted ATT Write Request. Versions prior to 2.0.2 are affected exclusively when at least one BLE characteristic is configured with the BLEEncryption property. No public exploit has been identified at time of analysis, but vendor-released patch version 2.0.2 fully resolves the flaw.
Remote code execution in Windows iSCSI is possible due to incorrect buffer size calculation (CWE-131), affecting a broad swath of Windows releases from Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated attack path requiring some user interaction - consistent with a scenario where a victim system initiates an iSCSI connection to a malicious target. Microsoft has released patches addressing specific build thresholds across all affected Windows versions. No public exploit code or CISA KEV listing is present at time of analysis.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
Malformed BGP labeled-unicast UPDATE messages can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on affected routers (CVSS 8.7). Per the vendor CVSS vector the attack is unauthenticated (PR:N), but exploitation in practice requires two concrete preconditions: the sender must be a configured eBGP neighbor with an established BGP peering session to the target, and the affected BGP multipath features must be enabled on the router, with the trigger arriving as labeled-unicast UPDATEs. Impact is availability only - rpd crashes with no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, so this is primarily an operational-availability risk for Juniper networks that peer eBGP with external or less-trusted parties and run multipath.
A double-offset error in DPDK's vhost log-mapping calculation (lib/vhost) lets local attackers with low privileges (PR:L) - including a guest that controls a virtio device serviced by the vulnerable vhost-user backend - trigger incorrect host memory accesses that compromise confidentiality, integrity and availability, giving a 7.8 HIGH rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is tracked by Red Hat and ships in Fast Datapath for RHEL 8, 9 and 10, which in turn is consumed by Red Hat Enterprise Linux 8/9/10, OpenShift Container Platform 4 and OpenStack Platform 13 (Queens), so exposure is concentrated in OVS-DPDK accelerated virtualization and NFV hosts that exercise the vhost log-mapping path (for example during guest dirty-page logging/live migration). No public exploit identified at time of analysis, and no CISA KEV listing or exploit code is referenced in the available intelligence.
Incorrect buffer size calculation in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows allows a local attacker who already holds low-privileged code execution on the host to escalate to kernel-level privileges, with downstream risk of code execution, denial of service, information disclosure, and data tampering. The flaw affects GeForce, RTX/Quadro/NVS, Tesla data-center, and vGPU/Virtual GPU Manager drivers, and rates CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N) - it is strictly local, not remotely triggerable, so exposure is limited to shared workstations, multi-tenant vGPU/VDI environments, and cloud-GPU nodes where an untrusted party can already run code. No public exploit code or confirmed active exploitation was identified at time of analysis.
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpga FPGA SoCs lets a locally-positioned attacker who already holds high privileges corrupt firmware memory through an incorrectly calculated buffer size. All Trusted Firmware releases up to and including the socfpga_v2.14.0 branch are affected, and exploitation requires local access combined with high-privileged normal-world code execution capable of reaching the firmware's service interface - the flaw is not remotely reachable and cannot be triggered by an unprivileged user. There is no confirmed active exploitation and no public exploit identified at time of analysis; the assessed risk is primarily post-compromise privilege and trust escalation on the specific embedded hardware, with real-world exposure constrained by the local, high-privilege prerequisite.
Incorrect buffer size arithmetic in tinyexpr's new_expr() causes an undersized heap allocation for every arity-0 expression node (constants, variables, and zero-argument functions), which the parser then uses as a complete te_expr object. Because tinyexpr is a parsing library with no network surface of its own, exploitation requires a host application that feeds attacker-influenced expression strings to te_compile(), and the visible failure (deterministic process termination) is primarily observed in UBSan-instrumented development or CI builds rather than standard production builds. The binary-unauthenticated CVSS 3.1 score of 7.5 reflects a worst-case A:H impact, but our assessment downgrades availability to Low (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L) because plain release builds exhibit undefined behavior without a guaranteed crash; EPSS is 0.15% (4th percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis. An upstream fix commit is available.
Pre-authentication heap memory corruption in BusyBox's built-in TLS implementation can be triggered by a remote, unauthenticated attacker who sends a single crafted ClientKeyExchange handshake message to a BusyBox process acting as a TLS server, corrupting the heap and crashing the process (CVSS 3.1 base 7.5, availability-only with no confidentiality or integrity impact rated). Exploitation requires a BusyBox binary compiled with TLS support and reachable in a server role, a deployment pattern that is the exception rather than the norm since BusyBox TLS is most often used outbound (for example by wget https), which sharply narrows the realistically exposed population. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence; the issue is tracked by Red Hat via its CVE page and Bugzilla, with no public exploit identified at time of analysis.
Loading a crafted legacy X10 'static short' XBM image with SAIL versions prior to 1.0.0 triggers a forward heap buffer overflow in sail_codec_load_frame_v8_xbm() that lets a file-controlled write corrupt process state, reliably crash the consuming application, and potentially achieve code execution depending on the host's memory layout and mitigations. The flaw is reachable through sail_load_from_file, sail_load_from_memory, and sail_start_loading_*, but only when the destination image has an odd row stride (ceil(width/8) odd) and only on the X10 short path - the X11 'static char' path is explicitly unaffected. Exploitation is local and file-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) and requires the victim to open the malicious image; no public exploit code or confirmed active exploitation was identified at time of analysis, and the impact scales with image height.
Memory corruption in ArduinoBLE's ATT layer write request handler allows an unauthenticated BLE client within Bluetooth range to overflow the ATTClass global object's write buffer by sending a crafted ATT Write Request. Versions prior to 2.0.2 are affected exclusively when at least one BLE characteristic is configured with the BLEEncryption property. No public exploit has been identified at time of analysis, but vendor-released patch version 2.0.2 fully resolves the flaw.
Remote code execution in Windows iSCSI is possible due to incorrect buffer size calculation (CWE-131), affecting a broad swath of Windows releases from Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated attack path requiring some user interaction - consistent with a scenario where a victim system initiates an iSCSI connection to a malicious target. Microsoft has released patches addressing specific build thresholds across all affected Windows versions. No public exploit code or CISA KEV listing is present at time of analysis.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.