Monthly
A crafted PSD file can drive the ImageMagick PSD decoder into an infinite loop, consuming CPU indefinitely and denying service to any application that processes untrusted images. The flaw is an unvalidated image-resource-block offset in ParseImageResourceBlocks (CWE-196 integer conversion, escalating to CWE-835 infinite loop) that only manifests on 32-bit builds: ImageMagick 7.x before 7.1.2-32 and 6.x before 6.9.13-57, while 64-bit builds are not affected. Exploitation requires no authentication or user interaction wherever PSD parsing is exposed (upload, conversion, or thumbnail pipelines), but SSVC records Exploitation: none and Automatable: no, no public exploit is identified at time of analysis, and EPSS is modest at 0.40% (32nd percentile); availability-only impact drives the 7.5 CVSS score.
An attacker-supplied Truevision TGA image can force the Perl Imager module (versions before 1.036) to kill the entire hosting process: a colour map length of 32768 or more is read into a signed short, becomes negative, is cast to size_t, and turned into a near-SIZE_MAX allocation request that fails and makes Imager's allocator call exit(3). Exploitation requires only that the application pass untrusted image bytes to Imager->read() with TGA handling (explicit type 'tga' or auto-detection) - the CVSS vector is PR:N, so no authentication is needed, and the exit(3) is uncatchable, meaning Perl eval and Try::Tiny handlers cannot trap it and a single malicious file terminates the worker, request handler, or CLI process. Publicly available exploit code exists per the SSVC assessment (exploitation: poc), but the input does not record confirmed active exploitation (CISA KEV); the vendor CVSS of 9.1 (C:H/I:N/A:H) is overstated, since the independently assessed vector is C:N/I:N/A:H - this is a pure denial-of-service condition with no code execution, memory corruption, or data disclosure.
Denial of service in the Imager image-processing module for Perl (all versions before 1.033) allows remote attackers to crash a worker process by submitting an image whose EXIF IFD entry count is mishandled as a signed integer, triggering an near-address-space-sized memory allocation that fails and aborts the process. Any application that passes untrusted images through Imager's EXIF parsing is exposed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.
Integer overflow in RAUC versions prior to 1.15.2 allows signature bypass on 'plain' format bundles exceeding 2 GiB payload size, enabling attackers with bundle modification capability to alter unverified payload portions while retaining a valid signature. This affects embedded Linux systems relying on RAUC for secure firmware updates.
Out-of-bounds memory read and write in Tera Term's TTSSH2 SSH plugin exposes users who connect to attacker-controlled SSH servers to memory disclosure and potential client crashes. The root cause is an unsigned-to-signed integer conversion error (CWE-196) in the SSH connection handshake code, which can cause internal memory contents to be transmitted to the malicious server. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the network-reachable nature with no privilege requirement on the attacker side makes social-engineering lures a realistic delivery vector.
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may lead to denial of service or information. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Besu is a Java-based Ethereum client. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A crafted PSD file can drive the ImageMagick PSD decoder into an infinite loop, consuming CPU indefinitely and denying service to any application that processes untrusted images. The flaw is an unvalidated image-resource-block offset in ParseImageResourceBlocks (CWE-196 integer conversion, escalating to CWE-835 infinite loop) that only manifests on 32-bit builds: ImageMagick 7.x before 7.1.2-32 and 6.x before 6.9.13-57, while 64-bit builds are not affected. Exploitation requires no authentication or user interaction wherever PSD parsing is exposed (upload, conversion, or thumbnail pipelines), but SSVC records Exploitation: none and Automatable: no, no public exploit is identified at time of analysis, and EPSS is modest at 0.40% (32nd percentile); availability-only impact drives the 7.5 CVSS score.
An attacker-supplied Truevision TGA image can force the Perl Imager module (versions before 1.036) to kill the entire hosting process: a colour map length of 32768 or more is read into a signed short, becomes negative, is cast to size_t, and turned into a near-SIZE_MAX allocation request that fails and makes Imager's allocator call exit(3). Exploitation requires only that the application pass untrusted image bytes to Imager->read() with TGA handling (explicit type 'tga' or auto-detection) - the CVSS vector is PR:N, so no authentication is needed, and the exit(3) is uncatchable, meaning Perl eval and Try::Tiny handlers cannot trap it and a single malicious file terminates the worker, request handler, or CLI process. Publicly available exploit code exists per the SSVC assessment (exploitation: poc), but the input does not record confirmed active exploitation (CISA KEV); the vendor CVSS of 9.1 (C:H/I:N/A:H) is overstated, since the independently assessed vector is C:N/I:N/A:H - this is a pure denial-of-service condition with no code execution, memory corruption, or data disclosure.
Denial of service in the Imager image-processing module for Perl (all versions before 1.033) allows remote attackers to crash a worker process by submitting an image whose EXIF IFD entry count is mishandled as a signed integer, triggering an near-address-space-sized memory allocation that fails and aborts the process. Any application that passes untrusted images through Imager's EXIF parsing is exposed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.
Integer overflow in RAUC versions prior to 1.15.2 allows signature bypass on 'plain' format bundles exceeding 2 GiB payload size, enabling attackers with bundle modification capability to alter unverified payload portions while retaining a valid signature. This affects embedded Linux systems relying on RAUC for secure firmware updates.
Out-of-bounds memory read and write in Tera Term's TTSSH2 SSH plugin exposes users who connect to attacker-controlled SSH servers to memory disclosure and potential client crashes. The root cause is an unsigned-to-signed integer conversion error (CWE-196) in the SSH connection handshake code, which can cause internal memory contents to be transmitted to the malicious server. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the network-reachable nature with no privilege requirement on the attacker side makes social-engineering lures a realistic delivery vector.
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may lead to denial of service or information. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Besu is a Java-based Ethereum client. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.