Monthly
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access - including unprivileged users on BPF-enabled kernels - to load programs that incorrectly pass safety checks but destroy the upper 32 bits of kernel pointer registers at runtime via ALU32 ADD and SUB instructions. The runtime effect is either a program fault (availability impact) or exposure of the lower 32 bits of a kernel pointer as a leakable scalar, partially defeating kernel ASLR. A vendor patch is available at v0.2.4; no active exploitation or public exploit code has been identified at time of analysis.
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. Fixed in 0.2.4; no public exploit identified at time of analysis beyond the maintainer's regression test cases, which concretely demonstrate the bypass shape.
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. Given that IOS XR underpins carrier-grade routers and service-provider backbone infrastructure, successful exploitation could be highly disruptive to network operations.
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect calculation (CWE-682) within Ring 3 user application code, enabling a local, high-privilege adversary to elevate privileges within a Trust Domain. The CVSS 4.0 vector confirms local access with high privileges required and low C/I/A impact on the vulnerable system, with no subsequent-system (host/hypervisor) impact. No public exploit exists and the vulnerability is absent from CISA KEV, placing real-world risk squarely in multi-tenant confidential computing scenarios where intra-guest privilege containment is a security objective.
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
wolfSSL's x86_64 Curve25519 scalar multiplication yields a non-canonical shared secret when carry propagation overflows into bit 255 during final modular reduction, producing a result in [p, 2^255) rather than the required canonical range [0, p). Both the x64 and AVX2 hand-written assembly paths in fe_x25519_asm.S are affected, and only specific edge-case scalar/point combinations trigger the flaw. wolfSSL self-reported this correctness defect and published a fix via GitHub PR #10536; no public exploit exists and the vulnerability is absent from CISA KEV.
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access - including unprivileged users on BPF-enabled kernels - to load programs that incorrectly pass safety checks but destroy the upper 32 bits of kernel pointer registers at runtime via ALU32 ADD and SUB instructions. The runtime effect is either a program fault (availability impact) or exposure of the lower 32 bits of a kernel pointer as a leakable scalar, partially defeating kernel ASLR. A vendor patch is available at v0.2.4; no active exploitation or public exploit code has been identified at time of analysis.
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. Fixed in 0.2.4; no public exploit identified at time of analysis beyond the maintainer's regression test cases, which concretely demonstrate the bypass shape.
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. Given that IOS XR underpins carrier-grade routers and service-provider backbone infrastructure, successful exploitation could be highly disruptive to network operations.
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect calculation (CWE-682) within Ring 3 user application code, enabling a local, high-privilege adversary to elevate privileges within a Trust Domain. The CVSS 4.0 vector confirms local access with high privileges required and low C/I/A impact on the vulnerable system, with no subsequent-system (host/hypervisor) impact. No public exploit exists and the vulnerability is absent from CISA KEV, placing real-world risk squarely in multi-tenant confidential computing scenarios where intra-guest privilege containment is a security objective.
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
wolfSSL's x86_64 Curve25519 scalar multiplication yields a non-canonical shared secret when carry propagation overflows into bit 255 during final modular reduction, producing a result in [p, 2^255) rather than the required canonical range [0, p). Both the x64 and AVX2 hand-written assembly paths in fe_x25519_asm.S are affected, and only specific edge-case scalar/point combinations trigger the flaw. wolfSSL self-reported this correctness defect and published a fix via GitHub PR #10536; no public exploit exists and the vulnerability is absent from CISA KEV.