Monthly
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.
Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. No CISA KEV listing is present, constraining the assessed threat primarily to actors with internal Diameter network access.
Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener to corrupt heap memory, achieving full confidentiality, integrity, and availability impact. Release builds compiled with -DNDEBUG silently remove the EVUTIL_ASSERT length guard, causing memcpy to write a kernel-supplied 110-byte sockaddr_un into the 28-byte conn_address union field and overwriting the adjacent dns_request heap pointer. No public exploit has been identified at time of analysis, but the absence of privilege requirements and low attack complexity make this accessible to any local process with filesystem access to the socket path.
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial-of-service in libheif 1.23.0 and earlier crashes host processes when a crafted HEIF sequence file - accepted by heif_context_read_from_memory() - leaves the context with no registered sequence tracks and heif_context_get_track() is subsequently called. Debug builds abort on assert(has_sequence()) in HeifContext::get_track(); release builds reach undefined behavior by dereferencing m_tracks.begin()->second on an empty std::map, which typically causes a segfault. The flaw is reachable through documented public APIs after parsing attacker-controlled bytes, making it directly relevant to any service that processes untrusted HEIF or AVIF input. No public exploit code is identified at time of analysis, and no CISA KEV listing exists.
Denial-of-service in Apple iOS and iPadOS (all versions before 18.7.10) can be triggered by an attacker occupying a privileged network position - such as a network middleman - who sends malformed input that trips a reachable assertion, crashing the affected process or device. The CVSS vector confirms no attacker privileges are required and the attack is network-reachable, though user interaction and a specific network vantage point are prerequisites. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; Apple has released a vendor patch.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.
Denial of Service in Open5GS v2.7.6 targets the NUDM-UECM (Network Unified Data Management - UE Context Management) interface, where a crafted HTTP DELETE request triggers a reachable assertion failure that crashes the UDM process. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and SSVC 'Automatable: yes' rating indicate this is trivially scriptable over the network. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Reachable assertion in Open5GS v2.7.6 SMF crashes the Session Management Function via a crafted DELETE request to the /nsmf-pdusession/v1/sm-contexts endpoint, enabling unauthenticated remote denial of service against the 5G core. Per CVSS PR:N, no authentication is required, though network access to the internal Service Based Interface (SBI) is a practical prerequisite in standard deployments. No active exploitation has been confirmed (not in CISA KEV), no public exploit code is known, and SSVC rates this as non-automatable with partial technical impact - suggesting real-world risk is lower than the 7.5 CVSS score implies.
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.
Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. No CISA KEV listing is present, constraining the assessed threat primarily to actors with internal Diameter network access.
Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener to corrupt heap memory, achieving full confidentiality, integrity, and availability impact. Release builds compiled with -DNDEBUG silently remove the EVUTIL_ASSERT length guard, causing memcpy to write a kernel-supplied 110-byte sockaddr_un into the 28-byte conn_address union field and overwriting the adjacent dns_request heap pointer. No public exploit has been identified at time of analysis, but the absence of privilege requirements and low attack complexity make this accessible to any local process with filesystem access to the socket path.
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial-of-service in libheif 1.23.0 and earlier crashes host processes when a crafted HEIF sequence file - accepted by heif_context_read_from_memory() - leaves the context with no registered sequence tracks and heif_context_get_track() is subsequently called. Debug builds abort on assert(has_sequence()) in HeifContext::get_track(); release builds reach undefined behavior by dereferencing m_tracks.begin()->second on an empty std::map, which typically causes a segfault. The flaw is reachable through documented public APIs after parsing attacker-controlled bytes, making it directly relevant to any service that processes untrusted HEIF or AVIF input. No public exploit code is identified at time of analysis, and no CISA KEV listing exists.
Denial-of-service in Apple iOS and iPadOS (all versions before 18.7.10) can be triggered by an attacker occupying a privileged network position - such as a network middleman - who sends malformed input that trips a reachable assertion, crashing the affected process or device. The CVSS vector confirms no attacker privileges are required and the attack is network-reachable, though user interaction and a specific network vantage point are prerequisites. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; Apple has released a vendor patch.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.