Monthly
Heap-based buffer overflow in NoMachine's mDNS resource-record parsing enables unauthenticated, network-adjacent attackers to execute arbitrary code on affected installations, running in the context of the NoMachine service account. Exploitation requires the attacker to be on the same local link/multicast domain as the target (AV:A), with NoMachine's mDNS service discovery active and reachable; no authentication (PR:N) or user interaction (UI:N) is required, and complexity is low (AC:L), giving a CVSS 8.8 impact of high confidentiality, integrity, and availability. Originally reported through Trend Micro ZDI as ZDI-CAN-30982 (advisory ZDI-26-710), the flaw is a classic CWE-122 length-validation failure; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the practical risk is gated by the adjacency precondition rather than internet-wide reachability.
Heap-based buffer overflow in the GStreamer rtpL16depay element allows unauthenticated remote attackers to execute arbitrary code at the privilege level of the process hosting the pipeline. Only GStreamer-based software that actually instantiates rtpL16depay to depayload attacker-supplied RTP L16 (16-bit linear PCM) audio is exposed, so a passive RTP receiver or streaming server is effectively remotely exploitable while client-side applications may require the user to connect to a malicious stream. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix commit but no tagged patched release has been independently confirmed.
Code execution can be triggered in applications that use sharp before 0.35.4 on glibc-based Linux to decode untrusted AVIF or HEIF images, because the bundled libheif dependency contains heap buffer overflow flaws (CWE-122). The CVE record rates this 8.9 under CVSS 4.0 with a local vector and PR:N, but the independent assessment emphasizes that exploitation requires sharp's VipsForeignLoadHeif path to process attacker-controlled image data and is substantially easier when the Node.js executable is not compiled as PIE; non-glibc deployments and PIE builds reduce exposure. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Heap-based buffer overflow in FreeRDP's server-side rdpsnd audio channel before 3.32.1 lets a malicious RDP client corrupt heap memory during audio playback, potentially enabling code execution. Affected deployments are FreeRDP-based RDP servers with the rdpsnd virtual channel enabled; the CVSS 4.0 vector requires low privileges (PR:L), consistent with an established RDP client session rather than anonymous access. No public exploit code or CISA KEV confirmation was identified at time of analysis, and reliable code execution versus a crash is not confirmed.
Authenticated attackers can trigger a heap-based buffer overflow in the boa web server's formUpload() handler on TOTOLINK X2000R routers running firmware V1.0.0-B20250421.1327, potentially leading to arbitrary code execution. The vulnerability requires valid administrative credentials (PR:H) but no user interaction, and the management interface must be network-reachable. No public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Advantech ADAM-3600 remote terminal unit allows a network-reachable attacker who already holds high-privilege authenticated access to the device to corrupt heap memory and potentially achieve arbitrary code execution. The CVSS 4.0 vector (AV:N/AC:H/PR:H/UI:N, high confidentiality/integrity/availability impact) and the independent CVSS 3.1 assessment agree this is a post-authentication flaw requiring privileged credentials plus non-trivial heap grooming or a specific input path, so exploitation is not a trivial pre-auth network takeover. No public exploit code or CISA KEV entry is present in the available intelligence, and exploitation has not been confirmed in the wild; exact vulnerable firmware ranges are not specified in the input and must be scoped from the Advantech security advisory.
Heap buffer overflow in Pillow's JPEG decoder (all versions prior to 13.0.0) lets a crafted 8-bit lossless SOF3 JPEG corrupt heap memory, crash the process, and potentially achieve code execution when an application requests downscaling through draft() or thumbnail(). Exploitation is unauthenticated but conditional: the Pillow build must be linked against libjpeg-turbo 3.x, because libjpeg-turbo 2.x and IJG builds reject the SOF3 input outright, and the application must actually call draft()/thumbnail() on attacker-supplied images - a common pattern in upload/thumbnail pipelines, which is the realistic exposure surface. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 4.0 score of 9.2 reflects high confidentiality/integrity/availability impact, tempered by the AC:H rating derived from the narrow build-configuration prerequisite.
Heap-based buffer overflow in Pillow before 13.0.0 can corrupt memory and potentially enable arbitrary code execution when an application with the optional olefile dependency opens or thumbnails a crafted OLE2 FlashPix (FPX) image. The flaw is reachable by unauthenticated remote attackers who can supply malicious image input, but exposure is limited to deployments that have installed olefile and process untrusted FPX content; no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). The vendor-released patch is Pillow 13.0.0.
Heap buffer overflow and stale-heap disclosure in Pillow's compressed TIFF save path can crash the process and potentially enable code execution when an application writes TIFF data to an in-memory stream such as io.BytesIO. Affected are Pillow versions 2.0.0 through 12.x (fixed in 13.0.0) that use libtiff and process attacker-influenced out-of-line TIFF tags or retained ICC profiles; file paths and targets with real file descriptors are not affected. The flaw requires a specific combination of compressed saving, seek-past-end behavior, and controlled tag data (AC:H/AT:P), and no public exploit code has been identified at time of analysis.
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority to perform MQPUT operations crash the queue manager or potentially execute arbitrary code by supplying malformed message options. The advisory is scoped to these containerized IBM MQ products, and exploitation requires valid MQ credentials plus put authority, so this is not an unauthenticated attack. No public exploit identified at time of analysis, and IBM has released a vendor patch.
Heap-based buffer overflow in NoMachine's mDNS resource-record parsing enables unauthenticated, network-adjacent attackers to execute arbitrary code on affected installations, running in the context of the NoMachine service account. Exploitation requires the attacker to be on the same local link/multicast domain as the target (AV:A), with NoMachine's mDNS service discovery active and reachable; no authentication (PR:N) or user interaction (UI:N) is required, and complexity is low (AC:L), giving a CVSS 8.8 impact of high confidentiality, integrity, and availability. Originally reported through Trend Micro ZDI as ZDI-CAN-30982 (advisory ZDI-26-710), the flaw is a classic CWE-122 length-validation failure; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the practical risk is gated by the adjacency precondition rather than internet-wide reachability.
Heap-based buffer overflow in the GStreamer rtpL16depay element allows unauthenticated remote attackers to execute arbitrary code at the privilege level of the process hosting the pipeline. Only GStreamer-based software that actually instantiates rtpL16depay to depayload attacker-supplied RTP L16 (16-bit linear PCM) audio is exposed, so a passive RTP receiver or streaming server is effectively remotely exploitable while client-side applications may require the user to connect to a malicious stream. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix commit but no tagged patched release has been independently confirmed.
Code execution can be triggered in applications that use sharp before 0.35.4 on glibc-based Linux to decode untrusted AVIF or HEIF images, because the bundled libheif dependency contains heap buffer overflow flaws (CWE-122). The CVE record rates this 8.9 under CVSS 4.0 with a local vector and PR:N, but the independent assessment emphasizes that exploitation requires sharp's VipsForeignLoadHeif path to process attacker-controlled image data and is substantially easier when the Node.js executable is not compiled as PIE; non-glibc deployments and PIE builds reduce exposure. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Heap-based buffer overflow in FreeRDP's server-side rdpsnd audio channel before 3.32.1 lets a malicious RDP client corrupt heap memory during audio playback, potentially enabling code execution. Affected deployments are FreeRDP-based RDP servers with the rdpsnd virtual channel enabled; the CVSS 4.0 vector requires low privileges (PR:L), consistent with an established RDP client session rather than anonymous access. No public exploit code or CISA KEV confirmation was identified at time of analysis, and reliable code execution versus a crash is not confirmed.
Authenticated attackers can trigger a heap-based buffer overflow in the boa web server's formUpload() handler on TOTOLINK X2000R routers running firmware V1.0.0-B20250421.1327, potentially leading to arbitrary code execution. The vulnerability requires valid administrative credentials (PR:H) but no user interaction, and the management interface must be network-reachable. No public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Advantech ADAM-3600 remote terminal unit allows a network-reachable attacker who already holds high-privilege authenticated access to the device to corrupt heap memory and potentially achieve arbitrary code execution. The CVSS 4.0 vector (AV:N/AC:H/PR:H/UI:N, high confidentiality/integrity/availability impact) and the independent CVSS 3.1 assessment agree this is a post-authentication flaw requiring privileged credentials plus non-trivial heap grooming or a specific input path, so exploitation is not a trivial pre-auth network takeover. No public exploit code or CISA KEV entry is present in the available intelligence, and exploitation has not been confirmed in the wild; exact vulnerable firmware ranges are not specified in the input and must be scoped from the Advantech security advisory.
Heap buffer overflow in Pillow's JPEG decoder (all versions prior to 13.0.0) lets a crafted 8-bit lossless SOF3 JPEG corrupt heap memory, crash the process, and potentially achieve code execution when an application requests downscaling through draft() or thumbnail(). Exploitation is unauthenticated but conditional: the Pillow build must be linked against libjpeg-turbo 3.x, because libjpeg-turbo 2.x and IJG builds reject the SOF3 input outright, and the application must actually call draft()/thumbnail() on attacker-supplied images - a common pattern in upload/thumbnail pipelines, which is the realistic exposure surface. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 4.0 score of 9.2 reflects high confidentiality/integrity/availability impact, tempered by the AC:H rating derived from the narrow build-configuration prerequisite.
Heap-based buffer overflow in Pillow before 13.0.0 can corrupt memory and potentially enable arbitrary code execution when an application with the optional olefile dependency opens or thumbnails a crafted OLE2 FlashPix (FPX) image. The flaw is reachable by unauthenticated remote attackers who can supply malicious image input, but exposure is limited to deployments that have installed olefile and process untrusted FPX content; no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). The vendor-released patch is Pillow 13.0.0.
Heap buffer overflow and stale-heap disclosure in Pillow's compressed TIFF save path can crash the process and potentially enable code execution when an application writes TIFF data to an in-memory stream such as io.BytesIO. Affected are Pillow versions 2.0.0 through 12.x (fixed in 13.0.0) that use libtiff and process attacker-influenced out-of-line TIFF tags or retained ICC profiles; file paths and targets with real file descriptors are not affected. The flaw requires a specific combination of compressed saving, seek-past-end behavior, and controlled tag data (AC:H/AT:P), and no public exploit code has been identified at time of analysis.
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority to perform MQPUT operations crash the queue manager or potentially execute arbitrary code by supplying malformed message options. The advisory is scoped to these containerized IBM MQ products, and exploitation requires valid MQ credentials plus put authority, so this is not an unauthenticated attack. No public exploit identified at time of analysis, and IBM has released a vendor patch.