Monthly
Heap out-of-bounds reads and writes affect libsmb2 before release 6.3 through integer overflow in the DCE/RPC NDR decoder in lib/dcerpc.c. A malicious SMB server, or a machine-in-the-middle on an unsigned connection, can return crafted NetrShareEnum replies whose wrapping actual_count or max_count values cause undersized heap allocations and subsequent memory corruption when a client application calls smb2_share_enum_async(); the attacker needs no credentials but must control the server side or the network path, and the client must initiate the share enumeration on an unsigned connection. A public write-up describing the count overflow exists and is tagged as an exploit reference, but it is not verified as working exploit code, and no public exploit is otherwise identified; the vendor has released libsmb2 6.3 as the only complete fix, and the issue is prioritized for remediation this week per vuln.today.
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vulnerable compilation path, potentially allowing an unauthenticated network attacker to run arbitrary code on the GitLab server. The flaw is an integer overflow (CWE-190) affecting a broad version range from 7.0 through 19.5.1; exploitation is conditional on reaching the relevant regex-compilation functionality, and our assessment rates attack complexity as high despite the advisory CVSS of 10.0. Publicly available exploit code exists, but no CISA KEV designation is indicated in the provided data.
Remote denial of service in Eclipse OpenJ9 JITServer before 0.63.0 lets unauthenticated network attackers exhaust compilation worker threads by sending crafted TCP connections with a malicious 4-byte length prefix. The integer overflow in MessageBuffer::computeRequiredCapacity() drives a worker thread into an infinite loop at roughly 100% CPU, so a small number of connections can silently stop compilation services for all connected client JVMs. The vendor base score of 8.7 reflects availability-only impact; no public exploit was identified at time of analysis.
Integer overflow in the Eclipse ThreadX module manager lets a loaded module under-allocate an object-pool block and corrupt the adjacent byte-pool block. When a module calls txm_module_object_allocate with an object_size near ULONG_MAX, the manager's unchecked addition of its fixed 16-byte private header wraps, so the pool serves a block smaller than the header and the subsequent header write spills past its end into the neighbouring allocation. The issue is locally exploitable by a low-privileged attacker who already has code running inside a loaded module, affects only builds that compile in and use the ThreadX module subsystem, requires no user interaction, and no public exploit code was identified at time of analysis (no CISA KEV listing was provided).
Heap-based out-of-bounds write in the Eclipse ThreadX GUIX binary resource (font) loader: a font page header declaring first_glyph greater than last_glyph underflows the glyph count (CWE-190), the count-times-record-size allocation multiply then wraps to a small value, and the load pass writes attacker-controlled glyph records past the end of the undersized buffer. Exploitation requires the target embedded application to load an attacker-supplied or tampered GUIX binary font resource - the assessed vector is local (AV:L) with high attack complexity and required user/application interaction - so realistic exposure is limited to devices that parse externally sourced or updatable GUIX resources rather than fixed build-time font assets; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful corruption can yield code execution, data disclosure, or denial of service in the GUIX process context (CVSS 4.0 base 7.1).
Integer overflow in MikroTik RouterOS firewall SAME-target handling can crash or brick affected routers when an authenticated user with firewall/NAT rule privileges installs a manipulated ipt_SAME rule. The flaw affects RouterOS through 6.40.5, 6.44, and 7.20.8, with fixes in 7.21.5 and 7.23.1. No CISA KEV listing was provided and no public exploit was confirmed at time of analysis; the assessed impact is availability-only.
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a remote adjacent-network attacker to desynchronize the parser from the declared body length on LP64 builds, enabling either request smuggling in persistent or proxied contexts or a denial of service by forcing a worker to wait for an oversized body. Affected are all pupnp releases prior to 2.0.2 across the whole CPE range cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:*; no authentication (PR:N) and no user interaction (UI:N) are required, though exploitation is limited to adjacent/link-local reachability (AV:A) and to 64-bit builds where long is 64 bits and int is 32 bits. No public exploit identified at time of analysis; vendor-released patch: 2.0.2.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.
Heap out-of-bounds reads and writes affect libsmb2 before release 6.3 through integer overflow in the DCE/RPC NDR decoder in lib/dcerpc.c. A malicious SMB server, or a machine-in-the-middle on an unsigned connection, can return crafted NetrShareEnum replies whose wrapping actual_count or max_count values cause undersized heap allocations and subsequent memory corruption when a client application calls smb2_share_enum_async(); the attacker needs no credentials but must control the server side or the network path, and the client must initiate the share enumeration on an unsigned connection. A public write-up describing the count overflow exists and is tagged as an exploit reference, but it is not verified as working exploit code, and no public exploit is otherwise identified; the vendor has released libsmb2 6.3 as the only complete fix, and the issue is prioritized for remediation this week per vuln.today.
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vulnerable compilation path, potentially allowing an unauthenticated network attacker to run arbitrary code on the GitLab server. The flaw is an integer overflow (CWE-190) affecting a broad version range from 7.0 through 19.5.1; exploitation is conditional on reaching the relevant regex-compilation functionality, and our assessment rates attack complexity as high despite the advisory CVSS of 10.0. Publicly available exploit code exists, but no CISA KEV designation is indicated in the provided data.
Remote denial of service in Eclipse OpenJ9 JITServer before 0.63.0 lets unauthenticated network attackers exhaust compilation worker threads by sending crafted TCP connections with a malicious 4-byte length prefix. The integer overflow in MessageBuffer::computeRequiredCapacity() drives a worker thread into an infinite loop at roughly 100% CPU, so a small number of connections can silently stop compilation services for all connected client JVMs. The vendor base score of 8.7 reflects availability-only impact; no public exploit was identified at time of analysis.
Integer overflow in the Eclipse ThreadX module manager lets a loaded module under-allocate an object-pool block and corrupt the adjacent byte-pool block. When a module calls txm_module_object_allocate with an object_size near ULONG_MAX, the manager's unchecked addition of its fixed 16-byte private header wraps, so the pool serves a block smaller than the header and the subsequent header write spills past its end into the neighbouring allocation. The issue is locally exploitable by a low-privileged attacker who already has code running inside a loaded module, affects only builds that compile in and use the ThreadX module subsystem, requires no user interaction, and no public exploit code was identified at time of analysis (no CISA KEV listing was provided).
Heap-based out-of-bounds write in the Eclipse ThreadX GUIX binary resource (font) loader: a font page header declaring first_glyph greater than last_glyph underflows the glyph count (CWE-190), the count-times-record-size allocation multiply then wraps to a small value, and the load pass writes attacker-controlled glyph records past the end of the undersized buffer. Exploitation requires the target embedded application to load an attacker-supplied or tampered GUIX binary font resource - the assessed vector is local (AV:L) with high attack complexity and required user/application interaction - so realistic exposure is limited to devices that parse externally sourced or updatable GUIX resources rather than fixed build-time font assets; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful corruption can yield code execution, data disclosure, or denial of service in the GUIX process context (CVSS 4.0 base 7.1).
Integer overflow in MikroTik RouterOS firewall SAME-target handling can crash or brick affected routers when an authenticated user with firewall/NAT rule privileges installs a manipulated ipt_SAME rule. The flaw affects RouterOS through 6.40.5, 6.44, and 7.20.8, with fixes in 7.21.5 and 7.23.1. No CISA KEV listing was provided and no public exploit was confirmed at time of analysis; the assessed impact is availability-only.
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a remote adjacent-network attacker to desynchronize the parser from the declared body length on LP64 builds, enabling either request smuggling in persistent or proxied contexts or a denial of service by forcing a worker to wait for an oversized body. Affected are all pupnp releases prior to 2.0.2 across the whole CPE range cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:*; no authentication (PR:N) and no user interaction (UI:N) are required, though exploitation is limited to adjacent/link-local reachability (AV:A) and to 64-bit builds where long is 64 bits and int is 32 bits. No public exploit identified at time of analysis; vendor-released patch: 2.0.2.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.