Monthly
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Heap-based buffer overflow in FLVMeta versions up to 1.2.2 allows remote attackers to trigger a crash via a crafted FLV file that manipulates the length argument passed to amf_string_new() during AMF string processing. A public proof-of-concept exists, but the CVSS 4.0 score of 2.1 reflects the strictly limited impact - low-severity availability disruption only, with no confidentiality or integrity consequences. The project maintainer has publicly disputed that the reported bugs are practically exploitable, further tempering the real-world risk assessment.
Heap-based buffer overflow in Open Asset Import Library (Assimp) through version 6.0.2 allows a local low-privilege attacker to corrupt heap memory by supplying a crafted MD5 mesh file. The root cause, confirmed by the patch diff, is that `MakeDataUnique()` pre-allocated only `faces × 3` vertex slots when the output can grow to `numOrigVerts + faces × 3` - meshes declaring more original vertices than face corners overflow the allocation. No public exploit exists and the vulnerability is absent from CISA KEV; impact is locally bounded with a CVSS 4.0 base score of 4.8.
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.
Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.
Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.
Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.
Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Heap-based buffer overflow in FLVMeta versions up to 1.2.2 allows remote attackers to trigger a crash via a crafted FLV file that manipulates the length argument passed to amf_string_new() during AMF string processing. A public proof-of-concept exists, but the CVSS 4.0 score of 2.1 reflects the strictly limited impact - low-severity availability disruption only, with no confidentiality or integrity consequences. The project maintainer has publicly disputed that the reported bugs are practically exploitable, further tempering the real-world risk assessment.
Heap-based buffer overflow in Open Asset Import Library (Assimp) through version 6.0.2 allows a local low-privilege attacker to corrupt heap memory by supplying a crafted MD5 mesh file. The root cause, confirmed by the patch diff, is that `MakeDataUnique()` pre-allocated only `faces × 3` vertex slots when the output can grow to `numOrigVerts + faces × 3` - meshes declaring more original vertices than face corners overflow the allocation. No public exploit exists and the vulnerability is absent from CISA KEV; impact is locally bounded with a CVSS 4.0 base score of 4.8.
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.
Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.
Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.
Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.
Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.