Monthly
Stack-based buffer overflow in libxml2 before 2.15.4 exposes applications that perform DTD element validation to potential arbitrary code execution via the `xmlSnprintfElements` function in `valid.c`. The function performs unbounded `strcat` calls into a caller-supplied fixed-size stack buffer when formatting element content model descriptions, with no remaining-capacity check before appending parentheses - allowing a crafted XML document with a sufficiently complex element content model to overflow adjacent stack memory. The fix is confirmed in libxml2 2.15.4 via a specific GitHub commit; no public exploit or active exploitation has been identified at time of analysis.
Stack buffer overflow in PJSIP's (pjproject) telnet CLI front-end allows unauthenticated network attackers to crash applications that have explicitly enabled the telnet administration interface. The functions send_err_arg() and send_ambi_arg() in cli_telnet.c wrote an attacker-influenced number of bytes into a fixed 256-byte stack buffer without bounds checking, with the error-position offset derived directly from parsed command input. The vulnerability is limited to application termination (DoS); no public exploit code has been identified at time of analysis, and the upstream fix is available as commit 4472a31.
Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the `handle_up_down()` function in `cli_telnet.c`. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size `PJ_CLI_MAX_CMDBUF` stack buffer, leading to application termination. Exploitation requires the telnet CLI front-end to be explicitly enabled; applications that do not enable this feature are entirely unaffected, and no public exploit or KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service by sending specially crafted network input that exceeds a stack-allocated buffer in a network-accessible component. The vulnerability is gated behind low-privilege authentication (PR:L) and carries no confidentiality or integrity impact, as IBM's advisory scores it CVSS 4.3 with A:L. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the IBM support portal.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows an authenticated local attacker to crash the system, producing a denial of service with no confidentiality or integrity impact. The flaw is classified as CWE-121 and is limited in severity by both the access prerequisites and the bounded availability-only outcome. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in libxml2 before 2.15.4 exposes applications that perform DTD element validation to potential arbitrary code execution via the `xmlSnprintfElements` function in `valid.c`. The function performs unbounded `strcat` calls into a caller-supplied fixed-size stack buffer when formatting element content model descriptions, with no remaining-capacity check before appending parentheses - allowing a crafted XML document with a sufficiently complex element content model to overflow adjacent stack memory. The fix is confirmed in libxml2 2.15.4 via a specific GitHub commit; no public exploit or active exploitation has been identified at time of analysis.
Stack buffer overflow in PJSIP's (pjproject) telnet CLI front-end allows unauthenticated network attackers to crash applications that have explicitly enabled the telnet administration interface. The functions send_err_arg() and send_ambi_arg() in cli_telnet.c wrote an attacker-influenced number of bytes into a fixed 256-byte stack buffer without bounds checking, with the error-position offset derived directly from parsed command input. The vulnerability is limited to application termination (DoS); no public exploit code has been identified at time of analysis, and the upstream fix is available as commit 4472a31.
Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the `handle_up_down()` function in `cli_telnet.c`. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size `PJ_CLI_MAX_CMDBUF` stack buffer, leading to application termination. Exploitation requires the telnet CLI front-end to be explicitly enabled; applications that do not enable this feature are entirely unaffected, and no public exploit or KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service by sending specially crafted network input that exceeds a stack-allocated buffer in a network-accessible component. The vulnerability is gated behind low-privilege authentication (PR:L) and carries no confidentiality or integrity impact, as IBM's advisory scores it CVSS 4.3 with A:L. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the IBM support portal.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows an authenticated local attacker to crash the system, producing a denial of service with no confidentiality or integrity impact. The flaw is classified as CWE-121 and is limited in severity by both the access prerequisites and the bounded availability-only outcome. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.