Monthly
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
Stack out-of-bounds write in Wazuh's root-level remoted daemon allows an authenticated agent to crash manager message processing by sending a specially crafted compressed payload over TCP port 1514. Versions 1.0.0 through 4.14.5 (stable) and 5.0.0-beta1 are affected; the decompression function writes a null terminator one byte beyond the stack buffer boundary when the message expands to exactly OS_MAXSTR bytes, corrupting the daemon stack and disrupting all agent communications. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; fixed versions 4.14.6 and 5.0.0-beta2 are available.
Incorrect buffer size validation in Sonos Tract's ONNX Initializer Loader allows a crafted ONNX model file to crash the inference process. The Tensor::from_raw_dt_align function in data/src/tensor.rs accepts a raw byte slice and declared tensor shape without confirming the slice length matches the expected size, causing a Rust panic in copy_from_slice when dimensions mismatch. Applications using Tract 0.23.0-0.23.4 to load untrusted or third-party ONNX models are at risk; a public proof-of-concept (GitHub issue #2390) confirms reproducibility, though no CISA KEV listing means confirmed threat-actor exploitation has not been observed.
Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.
Incorrect buffer size calculation (CWE-131) in an unidentified Linux distribution package tracked by both Ubuntu and Red Hat enables local, user-interaction-triggered exploitation with high confidentiality, integrity, and availability impact, yielding a CVSS base score of 7.8. The local attack vector combined with a user-interaction requirement (AV:L/UI:R/PR:N) is consistent with a malicious file parsing scenario, where a user opens a crafted input triggering the buffer miscalculation. No public exploit has been identified at time of analysis, and no KEV listing is present; however, the full C:H/I:H/A:H impact triad indicates potential for memory corruption leading to arbitrary code execution.
Heap-buffer-overflow vulnerabilities in GIMP's APNG file loader and DDS plug-in allow code execution when a user opens a specially crafted image file. The APNG flaw is triggered when the fcTL chunk width exceeds the IHDR width, causing pixel data to overwrite memory beyond the heap allocation; the DDS flaw stems from a bits-per-pixel mismatch in load_layer(). Both affect GIMP as packaged on Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.
Security policy bypass in Palo Alto Networks PAN-OS exposes protected services behind the firewall to traffic that should be blocked, exploitable by unauthenticated remote attackers via crafted IPv6 packets targeting the dataplane. The CVSS 4.0 score of 1.7 reflects that direct impact on the firewall itself is nil (VC:N/VI:N/VA:N), with only low-severity downstream effect on subsequent systems (SC:L/SI:L), and specific attack conditions must be present (AT:P). No public exploit code exists and no active exploitation has been reported (E:U), though the automatable flag (AU:Y) indicates the attack could in principle be scripted once conditions are met.
Local information disclosure and memory corruption in the Linux kernel's AMD KFD (amdkfd) driver affects GFX11/Navi3x GPUs, where the v11 MQD manager wrongly used CP-compute checkpoint/restore handlers for SDMA queues. During a CRIU checkpoint or restore of an SDMA queue, the driver treats a 512-byte v11_sdma_mqd buffer as a 2048-byte v11_compute_mqd, so it either leaks 1536 bytes of adjacent GTT memory to userspace or overwrites 1536 bytes of neighboring GTT memory (ring buffers or adjacent MQDs). Exploitation requires local access with the ability to drive CRIU checkpoint/restore of a GPU compute process; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Out-of-bounds memory access in the Linux kernel networking stack (net/core qdisc segmentation path) lets a local user feed malformed GSO (Generic Segmentation Offload) packets whose headers are not present in skb->head, causing drivers and net/core/tso.c (tso_build_hdr) to memcpy beyond valid bounds. The flaw can leak adjacent kernel memory and/or crash the system; it is not in CISA KEV and no public exploit has been identified, with a low EPSS of 0.15% (5th percentile) indicating low near-term exploitation likelihood. The upstream fix adds proper header pulling via pskb_may_pull() and a new SKB_DROP_REASON_SKB_BAD_GSO drop reason so malicious packets are dropped early.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
Stack out-of-bounds write in Wazuh's root-level remoted daemon allows an authenticated agent to crash manager message processing by sending a specially crafted compressed payload over TCP port 1514. Versions 1.0.0 through 4.14.5 (stable) and 5.0.0-beta1 are affected; the decompression function writes a null terminator one byte beyond the stack buffer boundary when the message expands to exactly OS_MAXSTR bytes, corrupting the daemon stack and disrupting all agent communications. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; fixed versions 4.14.6 and 5.0.0-beta2 are available.
Incorrect buffer size validation in Sonos Tract's ONNX Initializer Loader allows a crafted ONNX model file to crash the inference process. The Tensor::from_raw_dt_align function in data/src/tensor.rs accepts a raw byte slice and declared tensor shape without confirming the slice length matches the expected size, causing a Rust panic in copy_from_slice when dimensions mismatch. Applications using Tract 0.23.0-0.23.4 to load untrusted or third-party ONNX models are at risk; a public proof-of-concept (GitHub issue #2390) confirms reproducibility, though no CISA KEV listing means confirmed threat-actor exploitation has not been observed.
Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.
Incorrect buffer size calculation (CWE-131) in an unidentified Linux distribution package tracked by both Ubuntu and Red Hat enables local, user-interaction-triggered exploitation with high confidentiality, integrity, and availability impact, yielding a CVSS base score of 7.8. The local attack vector combined with a user-interaction requirement (AV:L/UI:R/PR:N) is consistent with a malicious file parsing scenario, where a user opens a crafted input triggering the buffer miscalculation. No public exploit has been identified at time of analysis, and no KEV listing is present; however, the full C:H/I:H/A:H impact triad indicates potential for memory corruption leading to arbitrary code execution.
Heap-buffer-overflow vulnerabilities in GIMP's APNG file loader and DDS plug-in allow code execution when a user opens a specially crafted image file. The APNG flaw is triggered when the fcTL chunk width exceeds the IHDR width, causing pixel data to overwrite memory beyond the heap allocation; the DDS flaw stems from a bits-per-pixel mismatch in load_layer(). Both affect GIMP as packaged on Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.
Security policy bypass in Palo Alto Networks PAN-OS exposes protected services behind the firewall to traffic that should be blocked, exploitable by unauthenticated remote attackers via crafted IPv6 packets targeting the dataplane. The CVSS 4.0 score of 1.7 reflects that direct impact on the firewall itself is nil (VC:N/VI:N/VA:N), with only low-severity downstream effect on subsequent systems (SC:L/SI:L), and specific attack conditions must be present (AT:P). No public exploit code exists and no active exploitation has been reported (E:U), though the automatable flag (AU:Y) indicates the attack could in principle be scripted once conditions are met.
Local information disclosure and memory corruption in the Linux kernel's AMD KFD (amdkfd) driver affects GFX11/Navi3x GPUs, where the v11 MQD manager wrongly used CP-compute checkpoint/restore handlers for SDMA queues. During a CRIU checkpoint or restore of an SDMA queue, the driver treats a 512-byte v11_sdma_mqd buffer as a 2048-byte v11_compute_mqd, so it either leaks 1536 bytes of adjacent GTT memory to userspace or overwrites 1536 bytes of neighboring GTT memory (ring buffers or adjacent MQDs). Exploitation requires local access with the ability to drive CRIU checkpoint/restore of a GPU compute process; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Out-of-bounds memory access in the Linux kernel networking stack (net/core qdisc segmentation path) lets a local user feed malformed GSO (Generic Segmentation Offload) packets whose headers are not present in skb->head, causing drivers and net/core/tso.c (tso_build_hdr) to memcpy beyond valid bounds. The flaw can leak adjacent kernel memory and/or crash the system; it is not in CISA KEV and no public exploit has been identified, with a low EPSS of 0.15% (5th percentile) indicating low near-term exploitation likelihood. The upstream fix adds proper header pulling via pskb_may_pull() and a new SKB_DROP_REASON_SKB_BAD_GSO drop reason so malicious packets are dropped early.