Monthly
Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in `pdfioDictSetStringf`, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v1.6.5 is confirmed available.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Local privilege escalation in the Linux kernel's CAN Broadcast Manager (BCM) module allows an unprivileged local user to execute arbitrary code in kernel context. The flaw stems from an expired pointer dereference (CWE-825) in the handling of tasklets and timers, leading to use-after-free. No active exploitation or public exploit code has been identified, but successful exploitation results in full root compromise of the system.
Kernel object corruption in Zephyr RTOS (v4.1.0 through v4.4.0) lets a deprivileged user thread on CONFIG_USERSPACE builds re-initialize a live k_pipe to which it has been granted access, orphaning threads already blocked on that pipe. Because z_impl_k_pipe_init() unconditionally resets the ring buffer and wait queues without accounting for pended waiters, a subsequent timeout or wake drives sys_dlist_remove() through dangling pointers, producing an attacker-influenced invalid kernel write, list corruption, lost wakeups, and silent data loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix hardens the k_pipe_init syscall verifier.
Reachable code execution in the Ladybird browser arises from a dangling-reference flaw (CWE-825) in the WebAssembly ESM-integration module loader, where a stack-local Wasm::FunctionType is captured by reference and read after destruction. A malicious web page can chain the resulting stale result-type data into an arbitrary write via the WASM-GC array.set handler and gain code execution in the WebContent process. Reported by VulnCheck with publicly available exploit code exists; it is not listed in CISA KEV, so no confirmed active exploitation, but a working PoC lowers the barrier for weaponization.
Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.
Local privilege escalation and memory corruption in the Linux kernel BPF subsystem arises from a use-after-free in the open-coded task_vma iterator, which read task->mm locklessly and took mmap_read_trylock() without ever calling mmget(). On kernels where a concurrent task exit frees the mm_struct (not protected by SLAB_TYPESAFE_BY_RCU), a BPF program iterating that task's VMAs can access freed memory, enabling information disclosure or kernel control-flow corruption. The fix has been merged upstream; there is no public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Local privilege escalation via a use-after-free in the Linux kernel's BPF sockmap subsystem (unix_stream_bpf_update_proto) allows a local attacker with BPF/sockmap privileges to corrupt kernel memory by racing a BPF iterator program against an AF_UNIX socket close. The flaw is a race condition where the `peer` pointer becomes stale during a TCP_ESTABLISHED→TCP_CLOSE transition, leading to a sock_hold() on freed memory (confirmed by a KASAN slab-use-after-free report). With a CVSS of 7.8 (local, low complexity, low privileges) it carries high confidentiality, integrity, and availability impact, though EPSS is low (0.19%) and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's IPv6 ICMPv6 receive path (icmpv6_rcv()) allows stale pointers to freed socket buffer memory to be dereferenced after a pskb_pull() call relocates skb->head. The affected code cached the source and destination addresses (saddr/daddr) before the pull, and these stale references were only consumed by net_dbg_ratelimited() in the slow path, limiting practical impact. The flaw is fixed upstream across all maintained stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).
Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in `pdfioDictSetStringf`, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v1.6.5 is confirmed available.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Local privilege escalation in the Linux kernel's CAN Broadcast Manager (BCM) module allows an unprivileged local user to execute arbitrary code in kernel context. The flaw stems from an expired pointer dereference (CWE-825) in the handling of tasklets and timers, leading to use-after-free. No active exploitation or public exploit code has been identified, but successful exploitation results in full root compromise of the system.
Kernel object corruption in Zephyr RTOS (v4.1.0 through v4.4.0) lets a deprivileged user thread on CONFIG_USERSPACE builds re-initialize a live k_pipe to which it has been granted access, orphaning threads already blocked on that pipe. Because z_impl_k_pipe_init() unconditionally resets the ring buffer and wait queues without accounting for pended waiters, a subsequent timeout or wake drives sys_dlist_remove() through dangling pointers, producing an attacker-influenced invalid kernel write, list corruption, lost wakeups, and silent data loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix hardens the k_pipe_init syscall verifier.
Reachable code execution in the Ladybird browser arises from a dangling-reference flaw (CWE-825) in the WebAssembly ESM-integration module loader, where a stack-local Wasm::FunctionType is captured by reference and read after destruction. A malicious web page can chain the resulting stale result-type data into an arbitrary write via the WASM-GC array.set handler and gain code execution in the WebContent process. Reported by VulnCheck with publicly available exploit code exists; it is not listed in CISA KEV, so no confirmed active exploitation, but a working PoC lowers the barrier for weaponization.
Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.
Local privilege escalation and memory corruption in the Linux kernel BPF subsystem arises from a use-after-free in the open-coded task_vma iterator, which read task->mm locklessly and took mmap_read_trylock() without ever calling mmget(). On kernels where a concurrent task exit frees the mm_struct (not protected by SLAB_TYPESAFE_BY_RCU), a BPF program iterating that task's VMAs can access freed memory, enabling information disclosure or kernel control-flow corruption. The fix has been merged upstream; there is no public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Local privilege escalation via a use-after-free in the Linux kernel's BPF sockmap subsystem (unix_stream_bpf_update_proto) allows a local attacker with BPF/sockmap privileges to corrupt kernel memory by racing a BPF iterator program against an AF_UNIX socket close. The flaw is a race condition where the `peer` pointer becomes stale during a TCP_ESTABLISHED→TCP_CLOSE transition, leading to a sock_hold() on freed memory (confirmed by a KASAN slab-use-after-free report). With a CVSS of 7.8 (local, low complexity, low privileges) it carries high confidentiality, integrity, and availability impact, though EPSS is low (0.19%) and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's IPv6 ICMPv6 receive path (icmpv6_rcv()) allows stale pointers to freed socket buffer memory to be dereferenced after a pskb_pull() call relocates skb->head. The affected code cached the source and destination addresses (saddr/daddr) before the pull, and these stale references were only consumed by net_dbg_ratelimited() in the slow path, limiting practical impact. The flaw is fixed upstream across all maintained stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).