Monthly
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).