CWE-758
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Monthly
Undefined behavior in the DOM Streams component of Mozilla Firefox allows remote, unauthenticated attackers to trigger memory-safety-class corruption in the browser process when a victim loads attacker-controlled web content, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R). The flaw affects builds prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, and requires user interaction - the victim must open a crafted page that exercises the vulnerable Streams API path - but no authentication or non-default browser configuration is needed. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue; EPSS is very low at 0.16% (4th percentile), though the underlying CWE-758 memory-safety class means reliable weaponization would require substantial exploit-development effort rather than being trivially scriptable.
An undefined behavior vulnerability exists in the WebRTC Signaling component of Mozilla Firefox and Firefox ESR, potentially leading to information disclosure. This affects Firefox versions below 149 and Firefox ESR versions below 140.9. An attacker can exploit this through WebRTC signaling interactions to disclose sensitive information, though specific exploitation details remain limited in public disclosures.
An undefined behavior vulnerability exists in the WebRTC Signaling component of Mozilla Firefox and Firefox ESR, potentially enabling information disclosure attacks. Firefox versions prior to 149 and Firefox ESR versions prior to 140.9 are affected. While specific exploitation mechanics are not fully detailed in available public sources, the vulnerability is classified as an information disclosure issue that could allow attackers to extract sensitive data through malformed WebRTC signaling messages.
An undefined behavior vulnerability exists in the Firefox Audio/Video component that could lead to information disclosure. This affects all Firefox versions prior to 149. While specific exploitation details are limited due to missing CVSS and CWE data, the vulnerability's classification as information disclosure suggests an attacker could potentially access sensitive audio or video processing data or bypass security boundaries within the multimedia subsystem.
Linux kernel netfilter xt_IDLETIMER subsystem crashes when revision 0 rules reuse ALARM-type timer labels created by revision 1, triggering mod_timer() on an uninitialized timer_list. Affects Linux kernel 5.7+ through 6.19.x series. Local authenticated attackers with CAP_NET_ADMIN (PR:L) can cause kernel panic on systems with panic_on_warn=1, achieving high-severity local denial of service or potential privilege escalation via kernel memory corruption. EPSS score is very low (0.02%, 4th percentile) indicating minimal observed exploitation likelihood. No public exploit code identified at time of analysis.
Uninitialized heap memory disclosure in OpenSlide occurs because libtiff 4.7.1 changed how the indirect TIFF tile read path handles a partial bottom tile row, causing _openslide_tiff_read_tile() to request a full tile-height destination and pull uninitialized heap bytes into pixel data returned by openslide_read_region(). Only OpenSlide 4.0.0.10 and 4.0.0.11 official binary builds - or any OpenSlide build linked against libtiff 4.7.1 or newer - are affected, and exploitation requires a network service that renders attacker-supplied, non-NDPI TIFF-based whole-slide images; OpenSlide linked against libtiff 4.7.0 or earlier is explicitly not affected, and reliability of any actual data extraction depends on downstream pixel transparency handling and recompression, so the practical leak is limited and uncertain. No public exploit code was identified at time of analysis, and the issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
Incorrect interface method dispatch in Eclipse OpenJ9 up to version 0.60 causes the JVM to silently execute an unintended interface default method instead of raising AbstractMethodError or IllegalAccessError when a previously JIT-compiled concrete superclass method is subsequently recompiled as abstract. Applications running on OpenJ9 with dynamic class-loading or OSGi-style hot deployment are at risk of integrity violations - untended code paths execute where exceptions should be thrown. No confirmed active exploitation exists and this CVE does not appear in CISA KEV; EPSS data was not provided, and the high attack complexity (AC:H) and specific attack prerequisites (AT:P) significantly limit real-world exploitability.
Incorrect conditional-move output in the RustCrypto `cmov` crate's aarch64 backend causes cryptographic constant-time operations to silently produce wrong results on aarch64 platforms. The inline assembly implementations of `Cmov` and `CmovEq` compare full 32-bit register contents instead of the intended narrowed type widths when evaluating conditions, because Rust's inline assembly specification explicitly leaves upper register bits undefined for inputs smaller than the register size. A proof-of-concept demonstrating the failure is included in the advisory; the vulnerability is not listed in CISA KEV and no active exploitation has been reported.
Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::translators and XmlArchitectureCapability. Rated low severity (CVSS 2.1), this vulnerability is no authentication required, low attack complexity.
BACnet Stack prior to version 1.4.3 exhibits undefined behavior in the decode_signed32() function when processing signed-integer property values containing bytes with the high bit set, causing denial of service through integer overflow. Network-remote attackers can trigger this vulnerability by sending specially crafted BACnet packets with high-bit-set byte sequences, resulting in application instability or crash on embedded systems running vulnerable versions. The vulnerability is confirmed fixed in version 1.4.3.
Undefined behavior in the DOM Streams component of Mozilla Firefox allows remote, unauthenticated attackers to trigger memory-safety-class corruption in the browser process when a victim loads attacker-controlled web content, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R). The flaw affects builds prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, and requires user interaction - the victim must open a crafted page that exercises the vulnerable Streams API path - but no authentication or non-default browser configuration is needed. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue; EPSS is very low at 0.16% (4th percentile), though the underlying CWE-758 memory-safety class means reliable weaponization would require substantial exploit-development effort rather than being trivially scriptable.
An undefined behavior vulnerability exists in the WebRTC Signaling component of Mozilla Firefox and Firefox ESR, potentially leading to information disclosure. This affects Firefox versions below 149 and Firefox ESR versions below 140.9. An attacker can exploit this through WebRTC signaling interactions to disclose sensitive information, though specific exploitation details remain limited in public disclosures.
An undefined behavior vulnerability exists in the WebRTC Signaling component of Mozilla Firefox and Firefox ESR, potentially enabling information disclosure attacks. Firefox versions prior to 149 and Firefox ESR versions prior to 140.9 are affected. While specific exploitation mechanics are not fully detailed in available public sources, the vulnerability is classified as an information disclosure issue that could allow attackers to extract sensitive data through malformed WebRTC signaling messages.
An undefined behavior vulnerability exists in the Firefox Audio/Video component that could lead to information disclosure. This affects all Firefox versions prior to 149. While specific exploitation details are limited due to missing CVSS and CWE data, the vulnerability's classification as information disclosure suggests an attacker could potentially access sensitive audio or video processing data or bypass security boundaries within the multimedia subsystem.
Linux kernel netfilter xt_IDLETIMER subsystem crashes when revision 0 rules reuse ALARM-type timer labels created by revision 1, triggering mod_timer() on an uninitialized timer_list. Affects Linux kernel 5.7+ through 6.19.x series. Local authenticated attackers with CAP_NET_ADMIN (PR:L) can cause kernel panic on systems with panic_on_warn=1, achieving high-severity local denial of service or potential privilege escalation via kernel memory corruption. EPSS score is very low (0.02%, 4th percentile) indicating minimal observed exploitation likelihood. No public exploit code identified at time of analysis.
Uninitialized heap memory disclosure in OpenSlide occurs because libtiff 4.7.1 changed how the indirect TIFF tile read path handles a partial bottom tile row, causing _openslide_tiff_read_tile() to request a full tile-height destination and pull uninitialized heap bytes into pixel data returned by openslide_read_region(). Only OpenSlide 4.0.0.10 and 4.0.0.11 official binary builds - or any OpenSlide build linked against libtiff 4.7.1 or newer - are affected, and exploitation requires a network service that renders attacker-supplied, non-NDPI TIFF-based whole-slide images; OpenSlide linked against libtiff 4.7.0 or earlier is explicitly not affected, and reliability of any actual data extraction depends on downstream pixel transparency handling and recompression, so the practical leak is limited and uncertain. No public exploit code was identified at time of analysis, and the issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
Incorrect interface method dispatch in Eclipse OpenJ9 up to version 0.60 causes the JVM to silently execute an unintended interface default method instead of raising AbstractMethodError or IllegalAccessError when a previously JIT-compiled concrete superclass method is subsequently recompiled as abstract. Applications running on OpenJ9 with dynamic class-loading or OSGi-style hot deployment are at risk of integrity violations - untended code paths execute where exceptions should be thrown. No confirmed active exploitation exists and this CVE does not appear in CISA KEV; EPSS data was not provided, and the high attack complexity (AC:H) and specific attack prerequisites (AT:P) significantly limit real-world exploitability.
Incorrect conditional-move output in the RustCrypto `cmov` crate's aarch64 backend causes cryptographic constant-time operations to silently produce wrong results on aarch64 platforms. The inline assembly implementations of `Cmov` and `CmovEq` compare full 32-bit register contents instead of the intended narrowed type widths when evaluating conditions, because Rust's inline assembly specification explicitly leaves upper register bits undefined for inputs smaller than the register size. A proof-of-concept demonstrating the failure is included in the advisory; the vulnerability is not listed in CISA KEV and no active exploitation has been reported.
Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::translators and XmlArchitectureCapability. Rated low severity (CVSS 2.1), this vulnerability is no authentication required, low attack complexity.
BACnet Stack prior to version 1.4.3 exhibits undefined behavior in the decode_signed32() function when processing signed-integer property values containing bytes with the high bit set, causing denial of service through integer overflow. Network-remote attackers can trigger this vulnerability by sending specially crafted BACnet packets with high-bit-set byte sequences, resulting in application instability or crash on embedded systems running vulnerable versions. The vulnerability is confirmed fixed in version 1.4.3.