Monthly
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a remote adjacent-network attacker to desynchronize the parser from the declared body length on LP64 builds, enabling either request smuggling in persistent or proxied contexts or a denial of service by forcing a worker to wait for an oversized body. Affected are all pupnp releases prior to 2.0.2 across the whole CPE range cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:*; no authentication (PR:N) and no user interaction (UI:N) are required, though exploitation is limited to adjacent/link-local reachability (AV:A) and to 64-bit builds where long is 64 bits and int is 32 bits. No public exploit identified at time of analysis; vendor-released patch: 2.0.2.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Out-of-bounds read in the Driftregion iso14229 UDS server library before version 0.10.1 lets an unauthenticated sender crash the diagnostic stack or disclose adjacent memory by submitting a short RequestFileTransfer (SID 0x38) request whose filePathAndNameLength field is set to 0xFFFC-0xFFFF, wrapping the length arithmetic and defeating the buffer-length check before file-transfer callbacks read past the receive buffer. The issue carries a CVSS 4.0 base score of 8.8 and is assessed as AV:N/AC:L/PR:N/UI:N with low confidentiality and high availability impact (CWE-190 integer wraparound), so no credentials or user interaction are required once the handler is reachable. No public exploit code has been identified at time of analysis and no EPSS score was supplied; real-world exposure is gated by transport, since AV:N holds only where the server is reachable over an IP transport such as DoIP, whereas the typical CAN/ISO-TP deployment restricts an attacker to the vehicle or device bus.
Integer overflow in NASA's F´ (F Prime) Svc::FileUplink component allows an operator with command-link access to bypass the declared upload-size check and write file data beyond the intended boundary, corrupting file integrity and enabling large sparse-file growth or storage/resource exhaustion. The flaw affects releases prior to 4.2.0 and is reachable by any attacker who can deliver a crafted DATA packet carrying a byteOffset and dataSize whose unsigned U32 sum wraps below the declared file size; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) reflects network reachability, low complexity, low privileges, no user interaction, high integrity and availability impact, and no confidentiality impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV); the vendor-released fix is version 4.2.0.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved stems from an integer overflow/wraparound in the routing protocol daemon (rpd) OSPFv2 handling, allowing an unauthenticated adjacent attacker to disrupt or crash rpd by sending specifically crafted OSPFv2 packets onto an OSPF-enabled interface. Only devices with OSPFv2 configured and reachable at Layer 2 on the attacker's segment are exposed, which is the primary limiting factor; devices without OSPFv2 running are not affected. Scoring is CVSS 4.0 7.1 and CVSS 3.1 7.1 (AV:A/AC:L/PR:N/UI:N, availability-only impact), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected release trains.
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an authenticated high-privilege actor who can load and execute flight sequences bypass the sequencer's stack write bounds check via a U32 integer wraparound in a STORE directive, so memcpy writes outside the sequencer stack and can cause denial of service, memory corruption, and potentially code execution. It is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) because the malicious sequence must be supplied and run - typically requiring trusted commanding, uplink, or ground-system authority - making it an access-gated risk rather than an unauthenticated mass-exploitation threat. No public exploit has been identified at time of analysis, there is no CISA KEV entry, and the vendor released a fixed version (4.2.0).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: the Layer 2 address learning daemon (l2ald) contains an integer overflow/wraparound (CWE-190) that can be triggered by a crafted EVPN Type-2 (MAC/IP) route advertisement, causing the process to fail and disrupting EVPN-based Layer 2 forwarding. Affected are devices running EVPN with an established, configured BGP peering session; the attacker must control one of those configured EVPN BGP peers, so exposure is limited to environments where EVPN is deployed and peer trust is not strictly enforced. CVSS 8.7 (CVSS 4.0) and 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat.
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a remote adjacent-network attacker to desynchronize the parser from the declared body length on LP64 builds, enabling either request smuggling in persistent or proxied contexts or a denial of service by forcing a worker to wait for an oversized body. Affected are all pupnp releases prior to 2.0.2 across the whole CPE range cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:*; no authentication (PR:N) and no user interaction (UI:N) are required, though exploitation is limited to adjacent/link-local reachability (AV:A) and to 64-bit builds where long is 64 bits and int is 32 bits. No public exploit identified at time of analysis; vendor-released patch: 2.0.2.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Out-of-bounds read in the Driftregion iso14229 UDS server library before version 0.10.1 lets an unauthenticated sender crash the diagnostic stack or disclose adjacent memory by submitting a short RequestFileTransfer (SID 0x38) request whose filePathAndNameLength field is set to 0xFFFC-0xFFFF, wrapping the length arithmetic and defeating the buffer-length check before file-transfer callbacks read past the receive buffer. The issue carries a CVSS 4.0 base score of 8.8 and is assessed as AV:N/AC:L/PR:N/UI:N with low confidentiality and high availability impact (CWE-190 integer wraparound), so no credentials or user interaction are required once the handler is reachable. No public exploit code has been identified at time of analysis and no EPSS score was supplied; real-world exposure is gated by transport, since AV:N holds only where the server is reachable over an IP transport such as DoIP, whereas the typical CAN/ISO-TP deployment restricts an attacker to the vehicle or device bus.
Integer overflow in NASA's F´ (F Prime) Svc::FileUplink component allows an operator with command-link access to bypass the declared upload-size check and write file data beyond the intended boundary, corrupting file integrity and enabling large sparse-file growth or storage/resource exhaustion. The flaw affects releases prior to 4.2.0 and is reachable by any attacker who can deliver a crafted DATA packet carrying a byteOffset and dataSize whose unsigned U32 sum wraps below the declared file size; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) reflects network reachability, low complexity, low privileges, no user interaction, high integrity and availability impact, and no confidentiality impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV); the vendor-released fix is version 4.2.0.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved stems from an integer overflow/wraparound in the routing protocol daemon (rpd) OSPFv2 handling, allowing an unauthenticated adjacent attacker to disrupt or crash rpd by sending specifically crafted OSPFv2 packets onto an OSPF-enabled interface. Only devices with OSPFv2 configured and reachable at Layer 2 on the attacker's segment are exposed, which is the primary limiting factor; devices without OSPFv2 running are not affected. Scoring is CVSS 4.0 7.1 and CVSS 3.1 7.1 (AV:A/AC:L/PR:N/UI:N, availability-only impact), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected release trains.
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an authenticated high-privilege actor who can load and execute flight sequences bypass the sequencer's stack write bounds check via a U32 integer wraparound in a STORE directive, so memcpy writes outside the sequencer stack and can cause denial of service, memory corruption, and potentially code execution. It is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) because the malicious sequence must be supplied and run - typically requiring trusted commanding, uplink, or ground-system authority - making it an access-gated risk rather than an unauthenticated mass-exploitation threat. No public exploit has been identified at time of analysis, there is no CISA KEV entry, and the vendor released a fixed version (4.2.0).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: the Layer 2 address learning daemon (l2ald) contains an integer overflow/wraparound (CWE-190) that can be triggered by a crafted EVPN Type-2 (MAC/IP) route advertisement, causing the process to fail and disrupting EVPN-based Layer 2 forwarding. Affected are devices running EVPN with an established, configured BGP peering session; the attacker must control one of those configured EVPN BGP peers, so exposure is limited to environments where EVPN is deployed and peer trust is not strictly enforced. CVSS 8.7 (CVSS 4.0) and 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat.