Buffer Overflow
Monthly
Out-of-bounds reads in the X.Org X client libraries - libXrender before 0.9.13 and libXtst before 1.2.6 in the parsing paths covered by this entry, alongside the sibling fixes shipped in libX11 1.8.14, libXi 1.8.4 and libXpm 3.5.20 - let a malicious or compromised X server crash connecting clients by returning malformed protocol replies. The clients trust length, count and category fields supplied by the server (for example the depth, visual and subpixel counts used when building XRenderInfo, and the datum/category handling in libXtst's XRecord reply parser) without validating them against the actual received buffer, so parsing walks past the end of the packet and causes a denial of service. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the attacker is unauthenticated from the network but exploitation requires user interaction - the victim must launch or connect an affected client to the hostile server (for example via ssh -X/-Y X11 forwarding to a compromised display) - and there is no public exploit identified at time of analysis.
Out-of-bounds reads and writes in the X.Org X client libraries (libX11, libXi, libXpm, libXrender and libXtst) can be triggered when a connecting X11 client parses crafted replies or events returned by a malicious, compromised, or man-in-the-middled X server, causing client crashes and, in a subset of cases, limited memory disclosure. The lead issue in the advisory is an out-of-bounds write in libX11's XKB action parser when a XkbGetMap reply contains keycode values above max_keycode + 1; the family also includes multiple out-of-bounds reads in libXi's XI2 class parsing and XQueryDeviceState/XListInputDevices replies, all of which are fixed in libX11 1.8.14, libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13 and libXtst 1.2.6. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) indicates exploitation is unauthenticated but requires user interaction, with impact limited to denial of service rather than confirmed code execution; no public exploit identified at time of analysis, and no KEV entry or EPSS score was supplied.
Multiple out-of-bounds read and write defects in the X.Org X client libraries (libX11, libXi, libXpm, libXrender, libXtst) let a malicious or compromised X server send crafted replies that drive client-side parsers past the end of the received buffer, crashing the linked application and, in the libX11 XKB case, writing past an allocated array. Affected are libX11 before 1.8.14, libXi before 1.8.4, libXpm before 3.5.20, libXrender before 0.9.13 and libXtst before 1.2.6; exploitation requires the victim's client to connect to an untrusted server and, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the craftwork is unauthenticated but needs user interaction, with demonstrated impact limited to denial of service rather than code execution. No CVSS vector, EPSS score, KEV entry or POC indicator was supplied for CVE-2026-109090 specifically, so no public exploit identified at time of analysis and quantitative exploitation signals are absent.
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.
Out-of-bounds heap reads in the RIOT OS DHCPv6 client (sys/net/application_layer/dhcpv6/client.c) let an attacker who controls, compromises, or spoofs a DHCPv6 server on the same local link crash an embedded device - and potentially expose or corrupt adjacent heap memory - by sending a REPLY whose IA_PD or IA_NA option body is shorter than the structure it is parsed as. Exploitation requires firmware built with MODULE_DHCPV6_CLIENT_IA_PD enabled and the device operating as a DHCPv6 client; no public exploit code was identified at time of analysis, and the issue is fixed in RIOT 2026.07. The upstream 9.8 score (AV:N/C:H/I:H/A:H) is tempered by DHCPv6's link-local scope and the compile-time gating of the vulnerable code path, consistent with the independent assessment of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.
Memory corruption in RIOT OS (versions prior to 2026.04) with the ATWINC15x0 Wi-Fi driver and MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled allows an adjacent unauthenticated attacker to trigger a buffer overflow by advertising a malformed or oversized SSID, potentially leading to a hard fault, denial of service, or code execution. Exploitation requires the device to perform a Wi-Fi scan and the attacker to be within radio range. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 2026.04.
Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Denial of service in mz-automation libIEC61850 prior to 1.6.2 allows an unauthenticated remote peer to exhaust CPU indefinitely by sending a malformed ACSE AARE PDU during association establishment. The bug is an out-of-bounds read (CWE-125) in parseUserInformation when a truncated long-form BER length makes BerDecoder_decodeLength return a negative position that is not validated, leading to a buffer[-1] access and a parse-reset loop; a process abort is possible only when the preceding byte lies on an inaccessible memory page, making that outcome memory-layout dependent. No public exploit code or active exploitation was identified at time of analysis, and the assessed impact is availability only (CVSS 3.1 7.5), not code execution or data disclosure.
Denial of service in mz-automation libIEC61850 before 1.6.2 lets a remote, unauthenticated attacker crash IEC 61850 servers by sending a single defineNamedVariableList MMS request. The bug is a stack out-of-bounds read (CWE-125) in checkDataSetAccess, where source and destination arguments are reversed in a StringUtils_copyStringToBuffer call used to build an MMS_ASSOCIATION_SPECIFIC dataset reference, so an uninitialized 130-byte stack buffer is treated as a source string and strlen walks past its bounds before those bytes are copied into the caller-owned listName buffer. Exposure is conditional: the server must have the dynamic dataset service enabled and a dataset access handler installed, both non-default integration choices, but any network-reachable server configured that way is trivially hit for a full loss of availability; the vulnerability is fixed in release v1.6.2 and no public exploit code was identified at time of analysis. No CISA KEV entry is associated with this CVE, and the tags indicating information disclosure reflect leaked stack bytes rather than a confirmed confidentiality breach, since the assessed impact is availability-only.
Rendering untrusted Markdown with the Go library github.com/gomarkdown/markdown while the html.Safelink hardening flag is enabled can crash the calling process: parser.IsSafeURL slices a link destination before validating its length and panics on empty, '.', or '..' destinations such as the input `[x]()`, and every version before 0.0.0-20260724235538-61af6e1e6971 is affected. The same panic is reachable without that flag by any downstream caller that passes a 0/1/2-byte attacker-controlled URL directly to the exported parser.IsSafeURL function, yielding a remote, unauthenticated, availability-only denial of service (CVSS 3.1 score 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is conditional rather than universal - the default render path with Safelink disabled never reaches the vulnerable code, there is no confirmed active exploitation (not in CISA KEV), and the upstream advisory itself publicly documents the minimal crash trigger.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.
Delta ISPSoft contains an out-of-bounds read (CWE-125) that can crash the application and potentially leak limited memory contents when a user opens a specially crafted project file. Exploitation is client-side and requires user interaction (opening the file on an engineering workstation), not remote access to a listening service, so the practical risk is moderate. No public exploit code has been identified at time of analysis.
Out-of-bounds read in Delta ISPSoft can disclose limited sensitive memory contents and cause a high availability impact when a user opens a specially crafted project or data file. The vulnerability affects installations of the Delta ISPSoft engineering software (CPE cpe:2.3:a:deltaww:ispsoft:*:*:*:*:*:*:*:* indicates no version limitation in the supplied data) and is a client-side file-parsing issue requiring user interaction, not an unattended network service flaw. No public exploit identified at time of analysis; the independent assessment rates it as a moderate-priority, client-side exposure rather than a mass-exploitable server vulnerability.
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's Workers component affects versions prior to 155.0.8059.84 and can allow a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim visits a crafted HTML page. The CVSS vector indicates network reachability, no authentication, and required user interaction, with high confidentiality, integrity, and availability impact inside the sandbox; however, Scope is Unchanged, so full host compromise requires a separate sandbox escape. Assessment signals conflict and should be weighed carefully: CVSS is 8.8 while Chromium rated it Medium, SSVC says exploitation is none and automatable is no, and no public exploit identified at time of analysis; a vendor patch is available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 lets a remote, unauthenticated attacker achieve arbitrary code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) - the target must navigate to attacker-controlled or compromised web content - and no public exploit code has been identified at time of analysis, with CISA SSVC rating current exploitation as 'none'. Because the code execution is explicitly confined to the sandbox (S:U), full host compromise would require chaining a separate sandbox-escape vulnerability, making this a high-priority patch item rather than an emergency.
Memory corruption in Google Chrome's DOM implementation allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 155.0.8059.84 are affected; exploitation is unauthenticated (CVSS PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and the resulting code execution is contained by the sandbox (S:U), so host compromise would require a separate sandbox-escape vulnerability. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, though the vendor's Chrome severity rating is High and technical impact is total for the compromised renderer; a vendor patch is available in Chrome 155.0.8059.84 and the corresponding extended stable update.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac/LTSC for Mac editions, allowing an unauthenticated attacker to execute arbitrary code by convincing a victim to open a specially crafted document (UI:R). The stack-based buffer overflow (CWE-121) requires no privileges or non-default configuration (PR:N, AC:L), making it a high-priority target for social-engineering campaigns, though no public exploit code has been identified at time of analysis. Patch available per vendor advisory from the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Stack-based buffer overflow in Microsoft Word permits remote code execution in affected Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC 2021/2024 (including Mac editions) when a victim opens a maliciously crafted document. The vulnerability is unauthenticated from the attacker's perspective but requires user interaction (UI:R), so delivery typically depends on phishing or social engineering, and no public exploit identified at time of analysis or CISA KEV confirmation is available in the provided data. Patch available per vendor advisory via Microsoft's MSRC update guide.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac when a user opens or previews a specially crafted document. The flaw is a stack-based buffer overflow (CWE-121) rated 8.8, reachable by unauthenticated remote attackers with PR:N but requiring user interaction with UI:R; successful exploitation yields code execution with the victim user’s privileges. A vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
Heap-based out-of-bounds reads and writes in bincookie prior to 0.1.9 occur when an application calls bincookie_init_file() on an attacker-supplied .binarycookies file, allowing the crafted input to drive byte-swap and iteration loops past a heap buffer sized only to the real file length. The vulnerable parser trusts file-controlled num_pages, page_sizes, and cookie_offsets as loop bounds, so malformed files can crash the host application or corrupt heap metadata in ways that could potentially lead to code execution. Exploitation requires local delivery of the crafted file and user interaction to make the target application parse it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8); no authentication to the parsing application is needed, and there is no public exploit identified at time of analysis. Version 0.1.9 fixes the issue by rejecting malformed files.
Denial of service in kin-openapi before 0.149.0 allows unauthenticated remote attackers to terminate the entire Go process by triggering unbounded recursion during runtime schema validation. When a loaded OpenAPI document contains an allOf, anyOf, or oneOf chain that refers back to an ancestor schema - a circular reference the loader and document validation accept without error - a request or response that reaches that schema causes Schema.visitJSON or openapi3filter.decodeValue to recurse until the goroutine stack is exhausted; the resulting fatal stack overflow cannot be caught with recover and aborts the whole process, including unrelated in-flight requests. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), driven entirely by availability with no confidentiality or integrity impact; the key limiting factor is that a vulnerable circular schema must already exist in the deployed spec, so default non-circular specs are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in version 0.149.0.
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.
Improper memory-buffer bounds handling in Unitronics UniStream Pro PLCs (B10 and C10 hardware variants) running UniLogic firmware prior to 1.41.329 allows an attacker with network reachability and low-privilege authentication (CVSS PR:L) to corrupt memory and potentially achieve high confidentiality and integrity impact with limited availability impact (CVSS 8.3). Because these are OT/ICS controllers, successful exploitation could let an authenticated actor disrupt or manipulate the logic and data handled by the device rather than just crash it. The flaw was reported by Israel's INCD; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so exploitation is currently assessed as requiring deliberate, targeted access rather than opportunistic scanning. Devices already running UniLogic 1.41.329 or later are not affected.
A stack-based buffer overflow in HPE NonStop XABroker can corrupt memory and terminate the broker process, handing an attacker who already holds a valid low-privilege account on the NonStop host a local denial-of-service primitive against a core system service. Exploitation is constrained: the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R) confirms the attack is local, requires an authenticated low-privilege account, and needs a separate user action to deliver or process the crafted input, with our independent assessment narrowing the impact to availability only (S:U/C:N/I:N/A:H) rather than the confidentiality and integrity loss implied by the vendor-published score. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so this rates as a moderate, availability-focused issue that matters most in environments where untrusted or semi-trusted users already have NonStop logon rights.
A stack-based buffer overflow in HPE NonStop ODBC/MX Server (CWE-121) allows a local attacker with valid low-privileged credentials and user interaction to corrupt memory, potentially causing an application crash and denial of service. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates local access, authentication, and user interaction are required, and the impact is confined to service disruption rather than confirmed code execution. No public exploit code or active exploitation has been identified at time of analysis.
HPE NonStop ODBC/MX Services contains a stack-based buffer overflow (CWE-121) that allows a locally authenticated attacker with low privileges to crash the application via crafted input, provided a user action is performed. The vulnerability is not remotely exploitable and requires user interaction; no public exploit was identified at time of analysis. Per independent assessment, the impact is limited to availability (application crash), with no confirmed confidentiality or integrity impact.
Local, authenticated attackers with low privileges can cause process termination or memory corruption in HPE NonStop SQL/MX UDR Server by sending a crafted message. The vulnerability is an improper input validation (CWE-20) issue in the UDR SERVER component that requires local access and a running UDR process. No public exploit identified at time of analysis; the primary impact is denial of service (availability high) with a low integrity impact and no confidentiality impact.
Stack buffer overflow in the HPE NonStop SQL/MX Executor allows an authenticated remote user to trigger memory corruption, yielding partial information disclosure and a high-availability impact in the form of a process crash. The flaw is reachable over the network with low attack complexity and no user interaction, but requires valid credentials with at least low-level privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.6), meaning an attacker must already be able to submit SQL to the Executor. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; the exposure is further limited because HPE NonStop is a specialized fault-tolerant platform rather than a commodity database, so this is a moderate-priority issue rather than an urgent one.
Memory corruption in the HPE NonStop HTTP WEBSERVER can be triggered by network-delivered HTTP input, causing the web server process to fail and potentially halting the NonStop system itself (CVSS 8.2, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Any HPE NonStop deployment that exposes the WEBSERVER component to an untrusted network is in scope, since the assessed vector requires no authentication, privileges, or user interaction against a listening server. The practical risk is bounded by the relatively small installed base of the NonStop platform and by the fact that the worst realistic outcome is availability loss rather than code execution or data disclosure; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
An authenticated local user on an HPE NonStop system can trigger a heap buffer overflow in the HPE NonStop Debug Utilities to corrupt a saved resume-execution address, potentially redirecting the flow of the debugged process. The flaw is rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) - the attacker needs an existing local foothold with only low privileges, but cannot reach the component remotely, no user interaction is required, and confidentiality is not impacted while integrity and availability are rated High. A vendor security bulletin is published, but no exact fixed version is given in the supplied data, and no public exploit code or CISA KEV entry has been identified at time of analysis; the practical risk is moderate and bounded by the requirement for local access and the platform-specific, diagnostic nature of the utility.
Heap-based buffer overflow in HPE NonStop Inspect Subsystem allows an authenticated local attacker with low privileges to corrupt a saved resume-execution address and potentially redirect control flow. The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects no confidentiality impact but high integrity and availability impact. No public exploit code or active exploitation is identified at time of analysis, and exploitation requires prior authenticated local access plus interaction with the Inspect debugging subsystem.
A heap buffer overflow in HPE NonStop OCAX lets an authenticated local actor corrupt the component's address space and potentially redirect execution flow, producing high integrity and availability impact with no confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Because the vector is AV:L with PR:L, exploitation requires pre-existing local access and at least low-privilege credentials on the NonStop system plus the ability to feed input to OCAX; it is not remotely reachable, so realistic exposure is limited to insiders or attackers who have already compromised a low-privilege account. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a medium-severity authenticated local issue rather than a top-tier emergency. HPE is the reporting vendor and the linked HPE Security Bulletin (hpesbns05148en_us) is the authoritative source for fixed versions.
Heap buffer overflow in HPE NonStop NDSREST (CVSS 7.1) can corrupt a resume-execution address and potentially redirect execution flow, producing high integrity and availability impact without confidentiality impact. Exploitation requires authenticated low-privilege local access (AV:L, PR:L), no user interaction, and low attack complexity; if NDSREST is network-exposed in a given deployment, effective reachability may be broader than the local vector suggests. No public exploit identified at time of analysis, and CISA KEV does not confirm active exploitation.
An out-of-bounds memory read in the SICK Safetyscanners Base C++ driver (CVE-2026-101290) lets a remote attacker crash the affected application by sending a specially crafted packet whose declared length is not properly validated during parsing. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is reachable over the network without authentication or user interaction, but the impact is strictly availability - the driver reads past the end of a buffer and the process terminates, producing a denial-of-service condition with no confidentiality or integrity effect and no code execution. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; real-world exposure is bounded by network reachability, since an attacker must be able to deliver malformed scanner-protocol traffic to the interface or port the driver parses, which in typical OT deployments requires presence on or routing into the industrial/scanner network segment. SICK AG published advisory SCA-2026-0015 covering the affected driver.
Out-of-bounds memory access in FreeBSD's bhyve hypervisor Intel HDA audio device emulation can be triggered by a privileged guest that supplies a zero-length Buffer Descriptor List entry and then modifies BDL fields after the hypervisor's validation step, causing an out-of-bounds read or write during DMA transfer processing. The concrete impact is a crash of the bhyve process or, potentially, arbitrary code execution in the host userspace context running the virtual machine, although any such execution remains confined by bhyve's Capsicum sandbox. Only hosts that expose the emulated HDA audio device to untrusted guests are affected, and exploitation requires local access from within a guest with device-programming privileges plus a high-complexity post-validation race (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0); no public exploit identified at time of analysis and the EPSS score is low at 0.18% (7th percentile).
Heap out-of-bounds write in the FreeBSD RACK TCP stack (CVE-2026-101307) lets a remote, unauthenticated attacker who completes a TCP handshake and sends a sufficient number of ACKs cause a 16-bit PCM sample-array growth counter to wrap to zero, producing a near-zero-length kernel heap allocation that is then overwritten with roughly 512 KB of existing sample data. The result is a kernel panic - availability impact only, with no confidentiality or integrity loss - and only FreeBSD 15.1-RELEASE before p5 hosts that have explicitly enabled the non-default RACK stack are exposed; stock FreeBSD hosts using the default stack are unaffected. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and EPSS is 0.17% (6th percentile), so the practical near-term risk is moderate and conditional on RACK being enabled.
Local attackers with low-privilege access can exploit a heap-based buffer overflow in HPE NonStop TNS/X Native Inspect to corrupt memory and potentially redirect execution flow, leading to code execution or denial of service. The vulnerability requires local, authenticated access (CVSS vector: AV:L/PR:L) and the ability to invoke the Native Inspect debugger utility. No public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in HPE NonStop SOAP 4.0 can be triggered remotely by a crafted SOAP request, resulting in a crash that takes down the affected NonStop system or SOAP service. The vulnerability is network-reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), scoring 8.2 with the impact concentrated on availability (A:H) alongside a limited integrity effect (I:L) and no confidentiality exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the realistic risk depends heavily on whether the SOAP listener is exposed beyond a restricted internal back-office network, making this a moderate-priority availability issue rather than a top-tier emergency.
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Out-of-bounds memory reads in HPE NonStop EXPAND - the networking subsystem of HPE's NonStop fault-tolerant server platform - can expose process memory contents and crash the EXPAND process, giving an adjacent-network attacker both information disclosure and a denial-of-service path. Exploitation requires network adjacency to a NonStop system's EXPAND communication path rather than arbitrary internet reach, no authentication or user interaction is needed, but high attack complexity means success depends on hard-to-control timing and process-state conditions, so reliable exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the EPSS signal (not provided) is not a driver here; practical risk is further bounded by the platform's narrow deployment footprint and the fact that EXPAND links normally sit on segmented internal or interconnect networks.
Kernel memory disclosure in DragonFly BSD through 6.4.2 (prior to commit 4bb22ff) allows an unauthenticated attacker on the adjacent Layer-2 broadcast domain to leak roughly 250 bytes each of kernel heap and stack memory - including kernel pointers - with a single crafted ARP request. The ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields, and in_arpreply() subsequently uses those attacker-controlled values as memcpy lengths against kernel buffers that are only 6 and 4 bytes long, copying the overread bytes back to the requester in the ARP reply. No authentication or user interaction is required, but impact is confined to adjacent-network attackers because ARP is not routed across subnets, and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in HPE NonStop TELSERV versions T9553L01^BAJ and earlier allows remote, unauthenticated attackers to corrupt memory and crash the service, causing a denial of service. The flaw is network-reachable with low complexity and requires no authentication or user interaction per the CVSS vector (PR:N/UI:N), so any party able to open a TELSERV session can attempt the overflow. No public exploit identified at time of analysis, and the impact is limited to availability - no code execution or data disclosure is described.
Out-of-bounds write in HPE NonStop QIOMON (T8671L02^ABH and earlier) allows a low-privilege authenticated actor to corrupt adjacent buffer memory when QIOMON processes attacker-influenced input, with the integrity and availability impact rated High and confidentiality impact Low. Exploitation is constrained on two fronts: the attacker must already hold authenticated low-privilege access to the NonStop environment (CVSS PR:L) and a legitimate user must perform an action that feeds malicious input into QIOMON (CVSS UI:R), so the issue is not exploitable as an end-to-end unauthenticated remote attack. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided, so it should be treated as a moderate-priority, non-emergency hardening item.
An out-of-bounds write in HPE NonStop CIPSAM (version T0693L02^BAU and earlier) lets an attacker with local access and at least low-level privileges corrupt adjacent buffer memory, producing High integrity and High availability impact on the affected NonStop system. The CVSS 3.1 base score of 8.7 is driven by the changed-scope metric combined with those impact values rather than by remote reach - the vector is AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H, so this is an authenticated, local-access issue and is not remotely exploitable by an unauthenticated attacker. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic attacker population is narrowed by the requirement for prior credentials on a proprietary, access-controlled mission-critical platform.
Stack-based memory corruption in the HPE NonStop SNMP Trap Multiplexer (T1041L01^BAA and earlier) lets remote, unauthenticated attackers crash the trap-handling service, producing a denial-of-service condition on the SNMP trap collection path. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms network reachability with no authentication, privileges, or user interaction required, but limits impact strictly to availability - there is no assessed loss of confidentiality or integrity, so code execution or data disclosure is not established by the available evidence. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore a remotely triggerable service crash on a specialized, typically network-segmented platform.
Unauthenticated remote denial of service in SODOLA SL902-SWTGW124AS switch firmware before version 200.2.12 lets any attacker who can reach the device's embedded HTTP management server crash it by sending a crafted multipart/form-data POST request containing an oversized boundary value in the Content-Type header. The overflow leaves the switch fully unresponsive, dropping both management access and traffic forwarding until its self-recovery cycle completes, though the assessment confirms no code execution, data disclosure, or configuration tampering occurs. Publicly available exploit code exists (published by the researcher and documented in the VulnCheck advisory), and the CVE carries a CVSS v4.0 base score of 8.7, but there is no indication of confirmed active exploitation in CISA KEV; the practical risk is governed mainly by whether the web management plane is exposed to attacker-reachable networks.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
Out-of-bounds read in Eclipse NetX Duo's X.509 certificate parser (routine `_nx_secure_x509_parse_signature_data`) lets a peer that supplies a certificate with an empty ASN.1 BIT STRING signature corrupt the parser's internal signature length to 0xFFFFFFFF and drive a signature pointer one byte past the end of the buffer, producing a crash or destabilization of the device. Because certificates are parsed from the remote peer during the TLS handshake, the issue is network-reachable and unauthenticated - affected devices are those acting as a TLS client toward an attacker-influenced server, or as a TLS server that requests client certificates; the independent assessment rates it AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H). Neither CISA KEV active exploitation nor public exploit code is associated with this CVE at time of analysis, and the principal limiting factor is reachability: only systems that negotiate TLS with untrusted peers are exposed.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.
Juniper Junos OS and Junos OS Evolved rpd contain a stack-based buffer overflow that an unauthenticated adjacent LDP peer can trigger with a malformed LDP Label Mapping message, causing an rpd crash or potentially arbitrary code execution. Exploitation requires LDP/MPLS to be configured and the attacker to have an LDP adjacency, so exposure is limited to MPLS-enabled routers rather than arbitrary internet-facing systems. Vendor patches are available; no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in the authd authentication daemon of Juniper Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service when both SNMP and AAA are enabled. Exploitation requires valid SNMP read credentials (low-privileged, authenticated) and the specific SNMP+AAA configuration, but no user interaction, making it a credible high-priority risk for devices with exposed SNMP management. Vendor patches are available; no public exploit was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an authenticated high-privilege actor who can load and execute flight sequences bypass the sequencer's stack write bounds check via a U32 integer wraparound in a STORE directive, so memcpy writes outside the sequencer stack and can cause denial of service, memory corruption, and potentially code execution. It is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) because the malicious sequence must be supplied and run - typically requiring trusted commanding, uplink, or ground-system authority - making it an access-gated risk rather than an unauthenticated mass-exploitation threat. No public exploit has been identified at time of analysis, there is no CISA KEV entry, and the vendor released a fixed version (4.2.0).
Stack-based buffer overflow in the srxpfe packet-forwarding daemon of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series lets a Layer-2-adjacent attacker execute arbitrary code as root by injecting crafted high-availability fabric traffic. This is a genuinely serious but access-constrained vulnerability: exploitation requires the SRX to be operating in a high-availability chassis cluster, and the attacker must already sit on the same Layer-2 segment as the HA fabric link - the flaw is not reachable over routed networks and does not affect standalone or non-clustered deployments. No authentication or user interaction is required once fabric adjacency is achieved (PR:N/UI:N per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and the vendor CVSS 4.0 score of 8.7), and no public exploit code has been identified at time of analysis; the vendor reports a patch is available via advisory JSA112186.
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.
Stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potentially execute commands with root privileges via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Exploitation requires that BMP be explicitly enabled (not default) and that the attacker have an established BGP session, meaning a configured neighbor or compromised peer. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited; patched releases are available from Juniper.
Unauthenticated remote code execution as root affects Juniper Junos OS on MX Series routers that are configured for IKE/IPsec with certificate-based authentication, due to a stack-based buffer overflow in the key management daemon (kmd). An attacker with network access to the IKE service can send specially crafted IKE certificate-based packets to trigger the overflow and execute arbitrary code with root privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the vendor has released patches and the vulnerability carries a critical severity rating (CVSS 9.3 from Juniper, 9.8 assessed).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved rpd allows an attacker with access to a configured BGP peering session to crash the routing protocol daemon by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. Affected are Junos OS and Junos OS Evolved versions 22.1R1 and later (22.1R1-EVO for Evolved); earlier releases are not vulnerable. Exploitation is conditional on both the BGP peer relationship and a non-default telemetry subscription, making this a conditional availability risk rather than a top-tier emergency; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured BGP flowspec peer to compromise the routing engine or cause a routing-daemon denial of service when BGP update-threading is enabled. The vendor CVSS 4.0 score is 9.3, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a genuinely high-priority issue whose exploitability is more constrained than the critical score alone suggests: the attacker must already be a configured flowspec BGP neighbor, and update-threading must be enabled, so devices without those conditions are not exposed. Vendor patches are available in fixed builds such as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, and 26.2R1-S2 (with corresponding Junos OS Evolved -EVO releases); no public exploit code has been identified at time of analysis.
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).
Out-of-bounds reads in the X.Org X client libraries - libXrender before 0.9.13 and libXtst before 1.2.6 in the parsing paths covered by this entry, alongside the sibling fixes shipped in libX11 1.8.14, libXi 1.8.4 and libXpm 3.5.20 - let a malicious or compromised X server crash connecting clients by returning malformed protocol replies. The clients trust length, count and category fields supplied by the server (for example the depth, visual and subpixel counts used when building XRenderInfo, and the datum/category handling in libXtst's XRecord reply parser) without validating them against the actual received buffer, so parsing walks past the end of the packet and causes a denial of service. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the attacker is unauthenticated from the network but exploitation requires user interaction - the victim must launch or connect an affected client to the hostile server (for example via ssh -X/-Y X11 forwarding to a compromised display) - and there is no public exploit identified at time of analysis.
Out-of-bounds reads and writes in the X.Org X client libraries (libX11, libXi, libXpm, libXrender and libXtst) can be triggered when a connecting X11 client parses crafted replies or events returned by a malicious, compromised, or man-in-the-middled X server, causing client crashes and, in a subset of cases, limited memory disclosure. The lead issue in the advisory is an out-of-bounds write in libX11's XKB action parser when a XkbGetMap reply contains keycode values above max_keycode + 1; the family also includes multiple out-of-bounds reads in libXi's XI2 class parsing and XQueryDeviceState/XListInputDevices replies, all of which are fixed in libX11 1.8.14, libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13 and libXtst 1.2.6. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) indicates exploitation is unauthenticated but requires user interaction, with impact limited to denial of service rather than confirmed code execution; no public exploit identified at time of analysis, and no KEV entry or EPSS score was supplied.
Multiple out-of-bounds read and write defects in the X.Org X client libraries (libX11, libXi, libXpm, libXrender, libXtst) let a malicious or compromised X server send crafted replies that drive client-side parsers past the end of the received buffer, crashing the linked application and, in the libX11 XKB case, writing past an allocated array. Affected are libX11 before 1.8.14, libXi before 1.8.4, libXpm before 3.5.20, libXrender before 0.9.13 and libXtst before 1.2.6; exploitation requires the victim's client to connect to an untrusted server and, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the craftwork is unauthenticated but needs user interaction, with demonstrated impact limited to denial of service rather than code execution. No CVSS vector, EPSS score, KEV entry or POC indicator was supplied for CVE-2026-109090 specifically, so no public exploit identified at time of analysis and quantitative exploitation signals are absent.
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.
Out-of-bounds heap reads in the RIOT OS DHCPv6 client (sys/net/application_layer/dhcpv6/client.c) let an attacker who controls, compromises, or spoofs a DHCPv6 server on the same local link crash an embedded device - and potentially expose or corrupt adjacent heap memory - by sending a REPLY whose IA_PD or IA_NA option body is shorter than the structure it is parsed as. Exploitation requires firmware built with MODULE_DHCPV6_CLIENT_IA_PD enabled and the device operating as a DHCPv6 client; no public exploit code was identified at time of analysis, and the issue is fixed in RIOT 2026.07. The upstream 9.8 score (AV:N/C:H/I:H/A:H) is tempered by DHCPv6's link-local scope and the compile-time gating of the vulnerable code path, consistent with the independent assessment of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.
Memory corruption in RIOT OS (versions prior to 2026.04) with the ATWINC15x0 Wi-Fi driver and MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled allows an adjacent unauthenticated attacker to trigger a buffer overflow by advertising a malformed or oversized SSID, potentially leading to a hard fault, denial of service, or code execution. Exploitation requires the device to perform a Wi-Fi scan and the attacker to be within radio range. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 2026.04.
Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Denial of service in mz-automation libIEC61850 prior to 1.6.2 allows an unauthenticated remote peer to exhaust CPU indefinitely by sending a malformed ACSE AARE PDU during association establishment. The bug is an out-of-bounds read (CWE-125) in parseUserInformation when a truncated long-form BER length makes BerDecoder_decodeLength return a negative position that is not validated, leading to a buffer[-1] access and a parse-reset loop; a process abort is possible only when the preceding byte lies on an inaccessible memory page, making that outcome memory-layout dependent. No public exploit code or active exploitation was identified at time of analysis, and the assessed impact is availability only (CVSS 3.1 7.5), not code execution or data disclosure.
Denial of service in mz-automation libIEC61850 before 1.6.2 lets a remote, unauthenticated attacker crash IEC 61850 servers by sending a single defineNamedVariableList MMS request. The bug is a stack out-of-bounds read (CWE-125) in checkDataSetAccess, where source and destination arguments are reversed in a StringUtils_copyStringToBuffer call used to build an MMS_ASSOCIATION_SPECIFIC dataset reference, so an uninitialized 130-byte stack buffer is treated as a source string and strlen walks past its bounds before those bytes are copied into the caller-owned listName buffer. Exposure is conditional: the server must have the dynamic dataset service enabled and a dataset access handler installed, both non-default integration choices, but any network-reachable server configured that way is trivially hit for a full loss of availability; the vulnerability is fixed in release v1.6.2 and no public exploit code was identified at time of analysis. No CISA KEV entry is associated with this CVE, and the tags indicating information disclosure reflect leaked stack bytes rather than a confirmed confidentiality breach, since the assessed impact is availability-only.
Rendering untrusted Markdown with the Go library github.com/gomarkdown/markdown while the html.Safelink hardening flag is enabled can crash the calling process: parser.IsSafeURL slices a link destination before validating its length and panics on empty, '.', or '..' destinations such as the input `[x]()`, and every version before 0.0.0-20260724235538-61af6e1e6971 is affected. The same panic is reachable without that flag by any downstream caller that passes a 0/1/2-byte attacker-controlled URL directly to the exported parser.IsSafeURL function, yielding a remote, unauthenticated, availability-only denial of service (CVSS 3.1 score 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is conditional rather than universal - the default render path with Safelink disabled never reaches the vulnerable code, there is no confirmed active exploitation (not in CISA KEV), and the upstream advisory itself publicly documents the minimal crash trigger.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.
Delta ISPSoft contains an out-of-bounds read (CWE-125) that can crash the application and potentially leak limited memory contents when a user opens a specially crafted project file. Exploitation is client-side and requires user interaction (opening the file on an engineering workstation), not remote access to a listening service, so the practical risk is moderate. No public exploit code has been identified at time of analysis.
Out-of-bounds read in Delta ISPSoft can disclose limited sensitive memory contents and cause a high availability impact when a user opens a specially crafted project or data file. The vulnerability affects installations of the Delta ISPSoft engineering software (CPE cpe:2.3:a:deltaww:ispsoft:*:*:*:*:*:*:*:* indicates no version limitation in the supplied data) and is a client-side file-parsing issue requiring user interaction, not an unattended network service flaw. No public exploit identified at time of analysis; the independent assessment rates it as a moderate-priority, client-side exposure rather than a mass-exploitable server vulnerability.
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's Workers component affects versions prior to 155.0.8059.84 and can allow a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim visits a crafted HTML page. The CVSS vector indicates network reachability, no authentication, and required user interaction, with high confidentiality, integrity, and availability impact inside the sandbox; however, Scope is Unchanged, so full host compromise requires a separate sandbox escape. Assessment signals conflict and should be weighed carefully: CVSS is 8.8 while Chromium rated it Medium, SSVC says exploitation is none and automatable is no, and no public exploit identified at time of analysis; a vendor patch is available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 lets a remote, unauthenticated attacker achieve arbitrary code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) - the target must navigate to attacker-controlled or compromised web content - and no public exploit code has been identified at time of analysis, with CISA SSVC rating current exploitation as 'none'. Because the code execution is explicitly confined to the sandbox (S:U), full host compromise would require chaining a separate sandbox-escape vulnerability, making this a high-priority patch item rather than an emergency.
Memory corruption in Google Chrome's DOM implementation allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 155.0.8059.84 are affected; exploitation is unauthenticated (CVSS PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and the resulting code execution is contained by the sandbox (S:U), so host compromise would require a separate sandbox-escape vulnerability. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, though the vendor's Chrome severity rating is High and technical impact is total for the compromised renderer; a vendor patch is available in Chrome 155.0.8059.84 and the corresponding extended stable update.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac/LTSC for Mac editions, allowing an unauthenticated attacker to execute arbitrary code by convincing a victim to open a specially crafted document (UI:R). The stack-based buffer overflow (CWE-121) requires no privileges or non-default configuration (PR:N, AC:L), making it a high-priority target for social-engineering campaigns, though no public exploit code has been identified at time of analysis. Patch available per vendor advisory from the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Stack-based buffer overflow in Microsoft Word permits remote code execution in affected Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC 2021/2024 (including Mac editions) when a victim opens a maliciously crafted document. The vulnerability is unauthenticated from the attacker's perspective but requires user interaction (UI:R), so delivery typically depends on phishing or social engineering, and no public exploit identified at time of analysis or CISA KEV confirmation is available in the provided data. Patch available per vendor advisory via Microsoft's MSRC update guide.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac when a user opens or previews a specially crafted document. The flaw is a stack-based buffer overflow (CWE-121) rated 8.8, reachable by unauthenticated remote attackers with PR:N but requiring user interaction with UI:R; successful exploitation yields code execution with the victim user’s privileges. A vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
Heap-based out-of-bounds reads and writes in bincookie prior to 0.1.9 occur when an application calls bincookie_init_file() on an attacker-supplied .binarycookies file, allowing the crafted input to drive byte-swap and iteration loops past a heap buffer sized only to the real file length. The vulnerable parser trusts file-controlled num_pages, page_sizes, and cookie_offsets as loop bounds, so malformed files can crash the host application or corrupt heap metadata in ways that could potentially lead to code execution. Exploitation requires local delivery of the crafted file and user interaction to make the target application parse it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8); no authentication to the parsing application is needed, and there is no public exploit identified at time of analysis. Version 0.1.9 fixes the issue by rejecting malformed files.
Denial of service in kin-openapi before 0.149.0 allows unauthenticated remote attackers to terminate the entire Go process by triggering unbounded recursion during runtime schema validation. When a loaded OpenAPI document contains an allOf, anyOf, or oneOf chain that refers back to an ancestor schema - a circular reference the loader and document validation accept without error - a request or response that reaches that schema causes Schema.visitJSON or openapi3filter.decodeValue to recurse until the goroutine stack is exhausted; the resulting fatal stack overflow cannot be caught with recover and aborts the whole process, including unrelated in-flight requests. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), driven entirely by availability with no confidentiality or integrity impact; the key limiting factor is that a vulnerable circular schema must already exist in the deployed spec, so default non-circular specs are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in version 0.149.0.
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.
Improper memory-buffer bounds handling in Unitronics UniStream Pro PLCs (B10 and C10 hardware variants) running UniLogic firmware prior to 1.41.329 allows an attacker with network reachability and low-privilege authentication (CVSS PR:L) to corrupt memory and potentially achieve high confidentiality and integrity impact with limited availability impact (CVSS 8.3). Because these are OT/ICS controllers, successful exploitation could let an authenticated actor disrupt or manipulate the logic and data handled by the device rather than just crash it. The flaw was reported by Israel's INCD; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so exploitation is currently assessed as requiring deliberate, targeted access rather than opportunistic scanning. Devices already running UniLogic 1.41.329 or later are not affected.
A stack-based buffer overflow in HPE NonStop XABroker can corrupt memory and terminate the broker process, handing an attacker who already holds a valid low-privilege account on the NonStop host a local denial-of-service primitive against a core system service. Exploitation is constrained: the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R) confirms the attack is local, requires an authenticated low-privilege account, and needs a separate user action to deliver or process the crafted input, with our independent assessment narrowing the impact to availability only (S:U/C:N/I:N/A:H) rather than the confidentiality and integrity loss implied by the vendor-published score. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so this rates as a moderate, availability-focused issue that matters most in environments where untrusted or semi-trusted users already have NonStop logon rights.
A stack-based buffer overflow in HPE NonStop ODBC/MX Server (CWE-121) allows a local attacker with valid low-privileged credentials and user interaction to corrupt memory, potentially causing an application crash and denial of service. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates local access, authentication, and user interaction are required, and the impact is confined to service disruption rather than confirmed code execution. No public exploit code or active exploitation has been identified at time of analysis.
HPE NonStop ODBC/MX Services contains a stack-based buffer overflow (CWE-121) that allows a locally authenticated attacker with low privileges to crash the application via crafted input, provided a user action is performed. The vulnerability is not remotely exploitable and requires user interaction; no public exploit was identified at time of analysis. Per independent assessment, the impact is limited to availability (application crash), with no confirmed confidentiality or integrity impact.
Local, authenticated attackers with low privileges can cause process termination or memory corruption in HPE NonStop SQL/MX UDR Server by sending a crafted message. The vulnerability is an improper input validation (CWE-20) issue in the UDR SERVER component that requires local access and a running UDR process. No public exploit identified at time of analysis; the primary impact is denial of service (availability high) with a low integrity impact and no confidentiality impact.
Stack buffer overflow in the HPE NonStop SQL/MX Executor allows an authenticated remote user to trigger memory corruption, yielding partial information disclosure and a high-availability impact in the form of a process crash. The flaw is reachable over the network with low attack complexity and no user interaction, but requires valid credentials with at least low-level privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.6), meaning an attacker must already be able to submit SQL to the Executor. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; the exposure is further limited because HPE NonStop is a specialized fault-tolerant platform rather than a commodity database, so this is a moderate-priority issue rather than an urgent one.
Memory corruption in the HPE NonStop HTTP WEBSERVER can be triggered by network-delivered HTTP input, causing the web server process to fail and potentially halting the NonStop system itself (CVSS 8.2, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Any HPE NonStop deployment that exposes the WEBSERVER component to an untrusted network is in scope, since the assessed vector requires no authentication, privileges, or user interaction against a listening server. The practical risk is bounded by the relatively small installed base of the NonStop platform and by the fact that the worst realistic outcome is availability loss rather than code execution or data disclosure; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
An authenticated local user on an HPE NonStop system can trigger a heap buffer overflow in the HPE NonStop Debug Utilities to corrupt a saved resume-execution address, potentially redirecting the flow of the debugged process. The flaw is rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) - the attacker needs an existing local foothold with only low privileges, but cannot reach the component remotely, no user interaction is required, and confidentiality is not impacted while integrity and availability are rated High. A vendor security bulletin is published, but no exact fixed version is given in the supplied data, and no public exploit code or CISA KEV entry has been identified at time of analysis; the practical risk is moderate and bounded by the requirement for local access and the platform-specific, diagnostic nature of the utility.
Heap-based buffer overflow in HPE NonStop Inspect Subsystem allows an authenticated local attacker with low privileges to corrupt a saved resume-execution address and potentially redirect control flow. The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects no confidentiality impact but high integrity and availability impact. No public exploit code or active exploitation is identified at time of analysis, and exploitation requires prior authenticated local access plus interaction with the Inspect debugging subsystem.
A heap buffer overflow in HPE NonStop OCAX lets an authenticated local actor corrupt the component's address space and potentially redirect execution flow, producing high integrity and availability impact with no confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Because the vector is AV:L with PR:L, exploitation requires pre-existing local access and at least low-privilege credentials on the NonStop system plus the ability to feed input to OCAX; it is not remotely reachable, so realistic exposure is limited to insiders or attackers who have already compromised a low-privilege account. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a medium-severity authenticated local issue rather than a top-tier emergency. HPE is the reporting vendor and the linked HPE Security Bulletin (hpesbns05148en_us) is the authoritative source for fixed versions.
Heap buffer overflow in HPE NonStop NDSREST (CVSS 7.1) can corrupt a resume-execution address and potentially redirect execution flow, producing high integrity and availability impact without confidentiality impact. Exploitation requires authenticated low-privilege local access (AV:L, PR:L), no user interaction, and low attack complexity; if NDSREST is network-exposed in a given deployment, effective reachability may be broader than the local vector suggests. No public exploit identified at time of analysis, and CISA KEV does not confirm active exploitation.
An out-of-bounds memory read in the SICK Safetyscanners Base C++ driver (CVE-2026-101290) lets a remote attacker crash the affected application by sending a specially crafted packet whose declared length is not properly validated during parsing. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is reachable over the network without authentication or user interaction, but the impact is strictly availability - the driver reads past the end of a buffer and the process terminates, producing a denial-of-service condition with no confidentiality or integrity effect and no code execution. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; real-world exposure is bounded by network reachability, since an attacker must be able to deliver malformed scanner-protocol traffic to the interface or port the driver parses, which in typical OT deployments requires presence on or routing into the industrial/scanner network segment. SICK AG published advisory SCA-2026-0015 covering the affected driver.
Out-of-bounds memory access in FreeBSD's bhyve hypervisor Intel HDA audio device emulation can be triggered by a privileged guest that supplies a zero-length Buffer Descriptor List entry and then modifies BDL fields after the hypervisor's validation step, causing an out-of-bounds read or write during DMA transfer processing. The concrete impact is a crash of the bhyve process or, potentially, arbitrary code execution in the host userspace context running the virtual machine, although any such execution remains confined by bhyve's Capsicum sandbox. Only hosts that expose the emulated HDA audio device to untrusted guests are affected, and exploitation requires local access from within a guest with device-programming privileges plus a high-complexity post-validation race (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0); no public exploit identified at time of analysis and the EPSS score is low at 0.18% (7th percentile).
Heap out-of-bounds write in the FreeBSD RACK TCP stack (CVE-2026-101307) lets a remote, unauthenticated attacker who completes a TCP handshake and sends a sufficient number of ACKs cause a 16-bit PCM sample-array growth counter to wrap to zero, producing a near-zero-length kernel heap allocation that is then overwritten with roughly 512 KB of existing sample data. The result is a kernel panic - availability impact only, with no confidentiality or integrity loss - and only FreeBSD 15.1-RELEASE before p5 hosts that have explicitly enabled the non-default RACK stack are exposed; stock FreeBSD hosts using the default stack are unaffected. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and EPSS is 0.17% (6th percentile), so the practical near-term risk is moderate and conditional on RACK being enabled.
Local attackers with low-privilege access can exploit a heap-based buffer overflow in HPE NonStop TNS/X Native Inspect to corrupt memory and potentially redirect execution flow, leading to code execution or denial of service. The vulnerability requires local, authenticated access (CVSS vector: AV:L/PR:L) and the ability to invoke the Native Inspect debugger utility. No public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in HPE NonStop SOAP 4.0 can be triggered remotely by a crafted SOAP request, resulting in a crash that takes down the affected NonStop system or SOAP service. The vulnerability is network-reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), scoring 8.2 with the impact concentrated on availability (A:H) alongside a limited integrity effect (I:L) and no confidentiality exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the realistic risk depends heavily on whether the SOAP listener is exposed beyond a restricted internal back-office network, making this a moderate-priority availability issue rather than a top-tier emergency.
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Out-of-bounds memory reads in HPE NonStop EXPAND - the networking subsystem of HPE's NonStop fault-tolerant server platform - can expose process memory contents and crash the EXPAND process, giving an adjacent-network attacker both information disclosure and a denial-of-service path. Exploitation requires network adjacency to a NonStop system's EXPAND communication path rather than arbitrary internet reach, no authentication or user interaction is needed, but high attack complexity means success depends on hard-to-control timing and process-state conditions, so reliable exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the EPSS signal (not provided) is not a driver here; practical risk is further bounded by the platform's narrow deployment footprint and the fact that EXPAND links normally sit on segmented internal or interconnect networks.
Kernel memory disclosure in DragonFly BSD through 6.4.2 (prior to commit 4bb22ff) allows an unauthenticated attacker on the adjacent Layer-2 broadcast domain to leak roughly 250 bytes each of kernel heap and stack memory - including kernel pointers - with a single crafted ARP request. The ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields, and in_arpreply() subsequently uses those attacker-controlled values as memcpy lengths against kernel buffers that are only 6 and 4 bytes long, copying the overread bytes back to the requester in the ARP reply. No authentication or user interaction is required, but impact is confined to adjacent-network attackers because ARP is not routed across subnets, and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in HPE NonStop TELSERV versions T9553L01^BAJ and earlier allows remote, unauthenticated attackers to corrupt memory and crash the service, causing a denial of service. The flaw is network-reachable with low complexity and requires no authentication or user interaction per the CVSS vector (PR:N/UI:N), so any party able to open a TELSERV session can attempt the overflow. No public exploit identified at time of analysis, and the impact is limited to availability - no code execution or data disclosure is described.
Out-of-bounds write in HPE NonStop QIOMON (T8671L02^ABH and earlier) allows a low-privilege authenticated actor to corrupt adjacent buffer memory when QIOMON processes attacker-influenced input, with the integrity and availability impact rated High and confidentiality impact Low. Exploitation is constrained on two fronts: the attacker must already hold authenticated low-privilege access to the NonStop environment (CVSS PR:L) and a legitimate user must perform an action that feeds malicious input into QIOMON (CVSS UI:R), so the issue is not exploitable as an end-to-end unauthenticated remote attack. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided, so it should be treated as a moderate-priority, non-emergency hardening item.
An out-of-bounds write in HPE NonStop CIPSAM (version T0693L02^BAU and earlier) lets an attacker with local access and at least low-level privileges corrupt adjacent buffer memory, producing High integrity and High availability impact on the affected NonStop system. The CVSS 3.1 base score of 8.7 is driven by the changed-scope metric combined with those impact values rather than by remote reach - the vector is AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H, so this is an authenticated, local-access issue and is not remotely exploitable by an unauthenticated attacker. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic attacker population is narrowed by the requirement for prior credentials on a proprietary, access-controlled mission-critical platform.
Stack-based memory corruption in the HPE NonStop SNMP Trap Multiplexer (T1041L01^BAA and earlier) lets remote, unauthenticated attackers crash the trap-handling service, producing a denial-of-service condition on the SNMP trap collection path. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms network reachability with no authentication, privileges, or user interaction required, but limits impact strictly to availability - there is no assessed loss of confidentiality or integrity, so code execution or data disclosure is not established by the available evidence. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore a remotely triggerable service crash on a specialized, typically network-segmented platform.
Unauthenticated remote denial of service in SODOLA SL902-SWTGW124AS switch firmware before version 200.2.12 lets any attacker who can reach the device's embedded HTTP management server crash it by sending a crafted multipart/form-data POST request containing an oversized boundary value in the Content-Type header. The overflow leaves the switch fully unresponsive, dropping both management access and traffic forwarding until its self-recovery cycle completes, though the assessment confirms no code execution, data disclosure, or configuration tampering occurs. Publicly available exploit code exists (published by the researcher and documented in the VulnCheck advisory), and the CVE carries a CVSS v4.0 base score of 8.7, but there is no indication of confirmed active exploitation in CISA KEV; the practical risk is governed mainly by whether the web management plane is exposed to attacker-reachable networks.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
Out-of-bounds read in Eclipse NetX Duo's X.509 certificate parser (routine `_nx_secure_x509_parse_signature_data`) lets a peer that supplies a certificate with an empty ASN.1 BIT STRING signature corrupt the parser's internal signature length to 0xFFFFFFFF and drive a signature pointer one byte past the end of the buffer, producing a crash or destabilization of the device. Because certificates are parsed from the remote peer during the TLS handshake, the issue is network-reachable and unauthenticated - affected devices are those acting as a TLS client toward an attacker-influenced server, or as a TLS server that requests client certificates; the independent assessment rates it AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H). Neither CISA KEV active exploitation nor public exploit code is associated with this CVE at time of analysis, and the principal limiting factor is reachability: only systems that negotiate TLS with untrusted peers are exposed.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.
Juniper Junos OS and Junos OS Evolved rpd contain a stack-based buffer overflow that an unauthenticated adjacent LDP peer can trigger with a malformed LDP Label Mapping message, causing an rpd crash or potentially arbitrary code execution. Exploitation requires LDP/MPLS to be configured and the attacker to have an LDP adjacency, so exposure is limited to MPLS-enabled routers rather than arbitrary internet-facing systems. Vendor patches are available; no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in the authd authentication daemon of Juniper Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service when both SNMP and AAA are enabled. Exploitation requires valid SNMP read credentials (low-privileged, authenticated) and the specific SNMP+AAA configuration, but no user interaction, making it a credible high-priority risk for devices with exposed SNMP management. Vendor patches are available; no public exploit was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an authenticated high-privilege actor who can load and execute flight sequences bypass the sequencer's stack write bounds check via a U32 integer wraparound in a STORE directive, so memcpy writes outside the sequencer stack and can cause denial of service, memory corruption, and potentially code execution. It is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) because the malicious sequence must be supplied and run - typically requiring trusted commanding, uplink, or ground-system authority - making it an access-gated risk rather than an unauthenticated mass-exploitation threat. No public exploit has been identified at time of analysis, there is no CISA KEV entry, and the vendor released a fixed version (4.2.0).
Stack-based buffer overflow in the srxpfe packet-forwarding daemon of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series lets a Layer-2-adjacent attacker execute arbitrary code as root by injecting crafted high-availability fabric traffic. This is a genuinely serious but access-constrained vulnerability: exploitation requires the SRX to be operating in a high-availability chassis cluster, and the attacker must already sit on the same Layer-2 segment as the HA fabric link - the flaw is not reachable over routed networks and does not affect standalone or non-clustered deployments. No authentication or user interaction is required once fabric adjacency is achieved (PR:N/UI:N per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and the vendor CVSS 4.0 score of 8.7), and no public exploit code has been identified at time of analysis; the vendor reports a patch is available via advisory JSA112186.
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.
Stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potentially execute commands with root privileges via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Exploitation requires that BMP be explicitly enabled (not default) and that the attacker have an established BGP session, meaning a configured neighbor or compromised peer. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited; patched releases are available from Juniper.
Unauthenticated remote code execution as root affects Juniper Junos OS on MX Series routers that are configured for IKE/IPsec with certificate-based authentication, due to a stack-based buffer overflow in the key management daemon (kmd). An attacker with network access to the IKE service can send specially crafted IKE certificate-based packets to trigger the overflow and execute arbitrary code with root privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the vendor has released patches and the vulnerability carries a critical severity rating (CVSS 9.3 from Juniper, 9.8 assessed).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved rpd allows an attacker with access to a configured BGP peering session to crash the routing protocol daemon by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. Affected are Junos OS and Junos OS Evolved versions 22.1R1 and later (22.1R1-EVO for Evolved); earlier releases are not vulnerable. Exploitation is conditional on both the BGP peer relationship and a non-default telemetry subscription, making this a conditional availability risk rather than a top-tier emergency; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured BGP flowspec peer to compromise the routing engine or cause a routing-daemon denial of service when BGP update-threading is enabled. The vendor CVSS 4.0 score is 9.3, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a genuinely high-priority issue whose exploitability is more constrained than the critical score alone suggests: the attacker must already be a configured flowspec BGP neighbor, and update-threading must be enabled, so devices without those conditions are not exposed. Vendor patches are available in fixed builds such as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, and 26.2R1-S2 (with corresponding Junos OS Evolved -EVO releases); no public exploit code has been identified at time of analysis.
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).