Buffer Overflow
Monthly
We need answer JSON only. Need synthesize. We need follow all fields string. Need careful no arrays except data_quality_flags should be JSON array of objects, but field is string? Instruction says every field plain text string NOT array/object. But data_quality_flags says JSON array of concrete... Hmm conflicting: "Every field below MUST be a plain text string — NOT an array, NOT an object, NOT nested JSON." but then data_quality_flags: "Empty array [] is correct". Need reconcile. They likely expect data_quality_flags as JSON array of objects, despite top says every field plain text? In previous tasks, data_quality_flags can be array. But user says "Return a JSON object with these fields:" Then "CRITICAL: Every field below MUST be a plain text string — NOT an array..." That includes data_quality_flags? However then data_quality_flags says JSON array. The system likely needs valid JSON. We should output data_quality_flags as [] (array) to satisfy specific field. Maybe top statement generalized but data_quality_flags exception. Need output valid JSON. Need analyze CVE. CVE-2026-39919 Ghostscript before 10.08.0 heap buffer overflow in JPEG2000 output adapter base/sjpx_openjpeg.c. Crafted PDF with JPEG2000 image mismatched component subsampling factors. Non-samescale sub-byte-depth output path allocates row buffer sized for packed output but writes full byte per output column regardless bit depth, overflowing allocation, corrupting chunk allocator metadata to achieve code execution. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = score 9.3? CVSS 9.3 critical. CWE-122 heap-based buffer overflow. Multi-source: patch available from vendor. Reported by VulnCheck. Tags: RCE, Buffer Overflow, Heap Overflow, Ghostscript. References: release tag gs10080, commit, bug, vulncheck advisory. Need produce fields. product_name: Ghostscript. 1-3 words. summary: original synthesis. Need start with specific impact verb and product. "Heap-based buffer overf
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.
A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.
A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.
Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.
An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.
Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.
Stack-based buffer overflow in the rzgl_asp CGI handler of D-Link DI-8300 firmware 16.07 lets a remote attacker who can reach the device's web management interface (and, per the CVSS vector, holds high/admin privileges) crash or execute code on the router by supplying an oversized redirct_url parameter to /rzgl.asp. Publicly available exploit code exists, so the vulnerability is trivially reproducible, although no CISA KEV listing or confirmed in-the-wild campaign is reported. The device is a legacy D-Link gateway, and no vendor patch or advisory was found in the supplied references.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.
We need answer JSON only. Need carefully construct fields. Need follow instructions. Must use all data. Need risk_assessment include "inowroclaw" once naturally. Need not mention editorial note. Need product_name 1-3 words. Vulnerability affects Apple multiple OSes. Primary product? "Apple iOS" maybe? Description lists iOS/iPadOS/macOS/tvOS/visionOS/watchOS. Product_name could be "Apple iOS" but affects multiple. Maybe "Apple OS"? Need 1-3 words. CPE is apple:ios_and_ipados, macos, tvos, visionos, watchos. Product name: "Apple iOS" or "Apple Operating Systems"? Specific product? The issue maybe in some component? Description doesn't say. Use "Apple iOS" as primary? But multiple. Could use "Apple OS". Need 1-3 words. I'd choose "Apple OS" maybe broad. Or "Apple iOS" given first. Product_name "Apple OS" acceptable? It says specific product or service name, not vendor alone. Multiple products, pick primary. Apple iOS and iPadOS? The CPE includes ios_and_ipados. primary "Apple iOS". Need relevant. Summary: original synthesis. Mention out-of-bounds write in OS component, remote attacker can cause app termination or arbitrary code execution. Affected versions. KEV? Not provided. POC? Not provided. EPSS? Not provided. Need mention if actively exploited, if POC exists, EPSS risk if notable. Since no KEV, POC, EPSS absent. Say no public exploit identified at time of analysis; KEV absent. But do not start with "A vulnerability". Start with specific impact verb and product: "Remote code execution in Apple operating systems due to an out-of-bounds write..." But description says may cause unexpected app termination or arbitrary code execution. Use "Out-of-bounds write in Apple OS...". Need not copy description exactly. Say affects iOS/iPadOS before etc. Let's craft. Need technical_context: underlying technology/library/protocol involved. Not specified. Root cause CWE-787 Out-of-bounds write. Explain memory corruption. CPE exact affected products. Apple OSes. Need be educationa
An out-of-bounds write in Apple macOS lets a malicious or compromised app running as a normal, unprivileged user corrupt memory and escalate to root privileges on the affected system. The flaw is fixed in macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8; all earlier releases of those branches remain exposed (CWE-787, CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and non-automatable, so practical risk is currently confined to local post-compromise privilege escalation rather than mass remote attacks.
Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.
Unexpected system termination is possible on unpatched Apple macOS hosts because of an out-of-bounds read that a remote attacker can trigger without authentication or user interaction. Apple addressed the flaw with improved bounds checking in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27, but the affected system component is not named in the public advisories. No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' while flagging the issue as automatable with partial technical impact; the CVSS 7.5 score is driven entirely by availability loss, with no confidentiality or integrity impact.
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Stack-based buffer overflow in the D-Link DIR-878 router (firmware 120B05) lets an authenticated attacker corrupt the stack by supplying an oversized IPv6Address/Hostname argument to the SetDynamicDNSIPv6Settings handler of the Dynamic DNS IPv6 Settings component. Because the flaw is reachable remotely over the web management interface and the CVSS 4.0 vector indicates full compromise of confidentiality, integrity and availability, successful exploitation can plausibly yield arbitrary code execution on the device. A public advisory exists on GitHub (Amalll-Sec router-vulnerability-research) and VulDB, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution affects the Contec EC1000 series (ECE1000, ECE1020, ECS1020) industrial devices, where a classic buffer overflow in the embedded web service allows a network-authenticated attacker to send a specially crafted HTTP request and execute arbitrary programs on the device. Reported by JPCERT/CC via JVN advisory JVNVU99009004, this is an embedded industrial controller flaw with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Contec RP-WAH-SR Series wireless access point devices via a classic buffer overflow in the product's web service. A low-privileged remote attacker can send a specially crafted HTTP request to trigger the overflow and execute arbitrary code on the device. All four model variants (SR1, SR2, SR12, SR22) are confirmed affected per CPE data; the vulnerability was disclosed via JPCERT and a Contec security advisory with no KEV listing or public POC at time of analysis.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privileged remote attacker to crash the device by sending a crafted HTTP request with an oversized IPMacBindRule argument to the formIPMacBindAdd handler. A public researcher advisory exists on GitHub from Amalll-Sec, indicating the vulnerability has been analyzed and documented with reproduction steps. Impact is assessed as high availability loss; remote code execution has not been independently confirmed from available data but cannot be excluded given the CWE-121 class.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis.
Remote buffer overflow in the Totolink A3002MU router's boa web server allows authenticated network attackers to overflow a fixed-size buffer in the formIpv6Setup handler by supplying an oversized `static_ipv6` argument, potentially enabling arbitrary code execution with root privileges on the device. The vulnerability affects firmware version Hh-B20211125.1046 and a proof-of-concept exploit has been publicly disclosed to GitHub. No vendor-released patch has been identified in available references at time of analysis.
Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. No patch is available at time of analysis; the vulnerability carries a CVSS 4.0 score of 8.6 with subsequent-system impact metrics elevated due to the router's central network position.
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
Heap buffer overflow in MKVToolNix through 101.0 allows code execution when a victim processes a crafted AVI file with mkvmerge. The bundled avilib 0.6.10 library's ODML superindex parser performs 32-bit size arithmetic on attacker-controlled entry counts, producing an integer wraparound (CWE-680) that causes an undersized heap allocation; subsequent data writes overflow the buffer. An attacker who delivers a malicious AVI file and induces a user or automated pipeline to process it with mkvmerge can achieve arbitrary code execution with user-level privileges. No public exploit has been identified and no KEV listing exists, but a patch commit is available on Codeberg.
SIPp's get_header() parser function in versions through 3.7.7 is vulnerable to a classic CWE-120 stack buffer overflow triggered by SIP messages containing header content exceeding approximately 20,490 bytes. Any unauthenticated network peer reaching the SIPp listener can crash the process with a single crafted SIP packet; the CVSS 4.0 vector (VA:H, no C/I impact) and source code evidence confirm this is an availability-only impact with no confirmed code-execution path. The upstream fix (commit 8ddfb43, PR #881) replaces unbounded sprintf() calls with snprintf() bounds enforcement, but no official tagged release incorporating the fix has been confirmed at time of analysis.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in `call_get_attribute()` (src/sip_call.c) and `msg_get_attribute()` (src/sip_msg.c), where unbounded `sprintf` calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix commit is publicly accessible, making independent weaponization feasible.
Heap buffer overflow in Freeciv's worklist_load() function allows memory corruption when a crafted savegame file declares a worklist length exceeding the fixed MAX_LEN_WORKLIST bound of 64 entries. Both savegame format v2 (savegame2.c) and v3 (savegame3.c) code paths are vulnerable in all releases before 3.2.6, meaning any user or server operator who loads a malicious .sav file may have heap-adjacent struct fields overwritten, potentially enabling arbitrary code execution. No public exploit has been identified at time of analysis, but the patch diff is publicly available on GitHub, lowering the bar for future weaponization.
Heap buffer overflow in stb_vorbis through 1.22 allows remote attackers to crash or corrupt the heap of any application that parses attacker-supplied Ogg Vorbis audio. The root cause is an integer truncation bug in start_decoder() where the codebook multiplicands allocation size is computed as a size_t but narrowed to int before being passed to the allocator, enabling a heap undersizing condition triggerable by crafting codebook entries and dimensions values that overflow the int range. No public exploit code or active exploitation is confirmed, but the no-interaction network vector makes this impactful for any service that accepts Ogg Vorbis input from untrusted sources.
Out-of-bounds write in the Linux kernel AppArmor LSM label parser allows any local user on an AppArmor-loaded system to corrupt kernel heap or stack memory by writing a crafted multi-component label string to /proc/self/attr/apparmor/current or to the world-writable (mode 0666) securityfs .access file, the latter path applying no privilege check whatsoever. The bug is a deterministic off-by-one: aa_vec_unique() writes a NULL terminator at vec[n] when no duplicates are found, but vec_setup() and DEFINE_VEC() allocate only n slots, so the write lands one entry past the end of either the local stack array or the kzalloc'd buffer. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.
Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.
Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). It is only reachable when a CephFS mount is re-exported over NFS; fixed by the new ceph_export_copy_name() helper that rejects over-length names with -ENAMETOOLONG. No public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.
Out-of-bounds read in the Linux kernel CephFS client (fs/ceph/mdsmap.c) lets a malicious or compromised Ceph monitor crash a client that has a CephFS mount. ceph_mdsmap_decode() advances its decode cursor by num_export_targets*4 bytes for each per-MDS info record without verifying enough bytes remain, and the only runaway-cursor guard is skipped for info versions 2 and 3, so an oversized count walks the cursor past the message front buffer and a later ceph_decode_32() reads slab memory out of bounds. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Out-of-bounds heap read and write in the Linux kernel's CIFS/SMB client (coalesce_t2() in fs/smb/client) allows a malicious or MITM SMB server to corrupt kernel memory or leak data by supplying a crafted Transaction2 DataOffset field. The function computes source and target data pointers directly from the server-controlled DataOffset with no bounds validation before a memcpy, so a small value overwrites header fields while a large value pushes the pointer past the buffer end. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the fix adds lower- and upper-bound checks for both pointers.
Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. No public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
Out-of-bounds kernel memory write in Linux kernel BPF stack unwinding (`__bpf_get_stack`) exposes CONFIG_PREEMPT systems to local privilege escalation. On fully preemptible kernels, a non-sleepable BPF raw tracepoint program runs under `migrate_disable()` but not `preempt_disable()`, creating a scheduler preemption window between per-CPU callchain buffer release and consumer memcpy; a concurrent task can overwrite `trace->nr`, inflating `copy_len` past the caller's buffer boundary. The vulnerability affects Linux 4.18 through stable branches preceding 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit exists and EPSS is 0.17%, but the C:H/I:H/A:H impact ratings reflect kernel memory corruption potential.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
Integer overflow in the Linux kernel's libnvdimm label-validation path allows a local low-privileged attacker with access to NVDIMM configuration commands (or crafted DIMM media) to trigger an out-of-bounds write in nd_label_data_init(). The on-media u32 field nslot, multiplied by sizeof_namespace_label() in 32-bit arithmetic introduced as a regression in Linux 4.13 (commit 564e871aa66f), wraps modulo 2^32 before the bounds check, causing a downstream memset() to overrun the config buffer. No public exploit code has been identified, and EPSS sits at 0.20% (10th percentile), reflecting realistic limited exposure given the niche hardware requirement.
Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), placing this in the low-probability-of-exploitation tier despite a CVSS score of 7.8.
Out-of-bounds reads in the Linux kernel SUNRPC RPCSEC_GSS privacy (krb5p) receive path allow a malicious or compromised NFS server to crash or leak memory from a connecting client. The function gss_unwrap_resp_priv() validated the opaque token length with a single u32 addition (offset + opaque_len) and no lower bound, so a crafted reply with opaque_len near 0xffffffff wraps the sum below rcv_buf->len and passes the check, while any length below GSS_KRB5_TOK_HDR_LEN is forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4/ptr+6 then run past the token. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a config-gated, DoS-leaning memory-safety bug rather than a broadly weaponizable RCE.
Remote out-of-bounds read and general protection fault in the Linux kernel's svcrdma (RPC-over-RDMA server) code allows a connected RDMA client to crash the kernel by advertising a Write or Reply chunk with zero segments. The pcl_for_each_segment iteration macro computed an inclusive upper bound of &ch_segments[ch_segcount - 1]; with a u32 ch_segcount of 0 this underflows to 0xFFFFFFFF, walking far past the flex array until it faults when svc_rdma_get_inv_rkey() dereferences segment->rs_handle. Fixed upstream; EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis.
Out-of-bounds heap write in the Linux kernel's server-side RPC-over-RDMA transport (svcrdma), used by the in-kernel NFS server, allows a malicious RPC-over-RDMA client to corrupt slab memory. When a client requests a reply (such as an NFS READ payload) without supplying a Write list or Reply chunk, and that reply needs more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_reply_msg() linearizes the entire reply into the fixed sc_max_req_size buffer; because the reply size is bounded only by the client request, the copy runs past the buffer and the oversized length is also posted to the device. There is no public exploit identified at time of analysis, and EPSS is low (0.17%).
Integer overflow in RISC-V KVM's SBI PMU EVENT_GET_INFO handler allows a guest VM to trigger out-of-bounds heap reads and writes on the host kernel, with scope-changed impact (C:H/I:H/A:H). A malicious or compromised guest on a RISC-V host running KVM can supply a crafted num_events value (e.g., 0x10000001 on RV64) that overflows a 32-bit multiplication, causing under-allocation of the event-info array while the subsequent loop iterates over the original large count - resulting in slab-out-of-bounds memory corruption confirmed by KASAN traces. No public exploit code exists and EPSS is 0.15%, but the scope change to the host kernel makes this a VM-escape class finding for RISC-V KVM deployments.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.
Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.
Slab out-of-bounds read in the Linux kernel's ocfs2 filesystem lets a crafted on-disk image trigger memory disclosure once mounted. The indexed-directory validators ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signature but never bound the ocfs2_dx_entry_list de_num_used/de_count counts against the 4KB metadata block capacity, so ocfs2_dx_dir_search() walks up to 0xffff entries far past the block. Any path lookup, stat(), or open() on an indexed directory in a malicious image reads adjacent slab memory. EPSS is low (0.20%, 10th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Out-of-bounds heap write in the Linux kernel's XDP subsystem allows memory corruption when an AF_XDP zero-copy packet is redirected through cpumap. The xdp_convert_zc_to_xdp_frame() routine copies an XSK packet into an order-0 page but advertises the full PAGE_SIZE as usable and records zero headroom, letting the frame overrun the page tail reserved for skb_shared_info and triggering a KASAN slab-out-of-bounds write in skb_gro_receive during GRO processing. No public exploit identified at time of analysis and EPSS is low (0.17%); the vendor has released fixes across stable branches.
Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.
Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.
We need answer JSON only. Need synthesize. We need follow all fields string. Need careful no arrays except data_quality_flags should be JSON array of objects, but field is string? Instruction says every field plain text string NOT array/object. But data_quality_flags says JSON array of concrete... Hmm conflicting: "Every field below MUST be a plain text string — NOT an array, NOT an object, NOT nested JSON." but then data_quality_flags: "Empty array [] is correct". Need reconcile. They likely expect data_quality_flags as JSON array of objects, despite top says every field plain text? In previous tasks, data_quality_flags can be array. But user says "Return a JSON object with these fields:" Then "CRITICAL: Every field below MUST be a plain text string — NOT an array..." That includes data_quality_flags? However then data_quality_flags says JSON array. The system likely needs valid JSON. We should output data_quality_flags as [] (array) to satisfy specific field. Maybe top statement generalized but data_quality_flags exception. Need output valid JSON. Need analyze CVE. CVE-2026-39919 Ghostscript before 10.08.0 heap buffer overflow in JPEG2000 output adapter base/sjpx_openjpeg.c. Crafted PDF with JPEG2000 image mismatched component subsampling factors. Non-samescale sub-byte-depth output path allocates row buffer sized for packed output but writes full byte per output column regardless bit depth, overflowing allocation, corrupting chunk allocator metadata to achieve code execution. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = score 9.3? CVSS 9.3 critical. CWE-122 heap-based buffer overflow. Multi-source: patch available from vendor. Reported by VulnCheck. Tags: RCE, Buffer Overflow, Heap Overflow, Ghostscript. References: release tag gs10080, commit, bug, vulncheck advisory. Need produce fields. product_name: Ghostscript. 1-3 words. summary: original synthesis. Need start with specific impact verb and product. "Heap-based buffer overf
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.
A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.
A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.
Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.
An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.
Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.
Stack-based buffer overflow in the rzgl_asp CGI handler of D-Link DI-8300 firmware 16.07 lets a remote attacker who can reach the device's web management interface (and, per the CVSS vector, holds high/admin privileges) crash or execute code on the router by supplying an oversized redirct_url parameter to /rzgl.asp. Publicly available exploit code exists, so the vulnerability is trivially reproducible, although no CISA KEV listing or confirmed in-the-wild campaign is reported. The device is a legacy D-Link gateway, and no vendor patch or advisory was found in the supplied references.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.
We need answer JSON only. Need carefully construct fields. Need follow instructions. Must use all data. Need risk_assessment include "inowroclaw" once naturally. Need not mention editorial note. Need product_name 1-3 words. Vulnerability affects Apple multiple OSes. Primary product? "Apple iOS" maybe? Description lists iOS/iPadOS/macOS/tvOS/visionOS/watchOS. Product_name could be "Apple iOS" but affects multiple. Maybe "Apple OS"? Need 1-3 words. CPE is apple:ios_and_ipados, macos, tvos, visionos, watchos. Product name: "Apple iOS" or "Apple Operating Systems"? Specific product? The issue maybe in some component? Description doesn't say. Use "Apple iOS" as primary? But multiple. Could use "Apple OS". Need 1-3 words. I'd choose "Apple OS" maybe broad. Or "Apple iOS" given first. Product_name "Apple OS" acceptable? It says specific product or service name, not vendor alone. Multiple products, pick primary. Apple iOS and iPadOS? The CPE includes ios_and_ipados. primary "Apple iOS". Need relevant. Summary: original synthesis. Mention out-of-bounds write in OS component, remote attacker can cause app termination or arbitrary code execution. Affected versions. KEV? Not provided. POC? Not provided. EPSS? Not provided. Need mention if actively exploited, if POC exists, EPSS risk if notable. Since no KEV, POC, EPSS absent. Say no public exploit identified at time of analysis; KEV absent. But do not start with "A vulnerability". Start with specific impact verb and product: "Remote code execution in Apple operating systems due to an out-of-bounds write..." But description says may cause unexpected app termination or arbitrary code execution. Use "Out-of-bounds write in Apple OS...". Need not copy description exactly. Say affects iOS/iPadOS before etc. Let's craft. Need technical_context: underlying technology/library/protocol involved. Not specified. Root cause CWE-787 Out-of-bounds write. Explain memory corruption. CPE exact affected products. Apple OSes. Need be educationa
An out-of-bounds write in Apple macOS lets a malicious or compromised app running as a normal, unprivileged user corrupt memory and escalate to root privileges on the affected system. The flaw is fixed in macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8; all earlier releases of those branches remain exposed (CWE-787, CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and non-automatable, so practical risk is currently confined to local post-compromise privilege escalation rather than mass remote attacks.
Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.
Unexpected system termination is possible on unpatched Apple macOS hosts because of an out-of-bounds read that a remote attacker can trigger without authentication or user interaction. Apple addressed the flaw with improved bounds checking in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27, but the affected system component is not named in the public advisories. No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' while flagging the issue as automatable with partial technical impact; the CVSS 7.5 score is driven entirely by availability loss, with no confidentiality or integrity impact.
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Stack-based buffer overflow in the D-Link DIR-878 router (firmware 120B05) lets an authenticated attacker corrupt the stack by supplying an oversized IPv6Address/Hostname argument to the SetDynamicDNSIPv6Settings handler of the Dynamic DNS IPv6 Settings component. Because the flaw is reachable remotely over the web management interface and the CVSS 4.0 vector indicates full compromise of confidentiality, integrity and availability, successful exploitation can plausibly yield arbitrary code execution on the device. A public advisory exists on GitHub (Amalll-Sec router-vulnerability-research) and VulDB, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution affects the Contec EC1000 series (ECE1000, ECE1020, ECS1020) industrial devices, where a classic buffer overflow in the embedded web service allows a network-authenticated attacker to send a specially crafted HTTP request and execute arbitrary programs on the device. Reported by JPCERT/CC via JVN advisory JVNVU99009004, this is an embedded industrial controller flaw with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Contec RP-WAH-SR Series wireless access point devices via a classic buffer overflow in the product's web service. A low-privileged remote attacker can send a specially crafted HTTP request to trigger the overflow and execute arbitrary code on the device. All four model variants (SR1, SR2, SR12, SR22) are confirmed affected per CPE data; the vulnerability was disclosed via JPCERT and a Contec security advisory with no KEV listing or public POC at time of analysis.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privileged remote attacker to crash the device by sending a crafted HTTP request with an oversized IPMacBindRule argument to the formIPMacBindAdd handler. A public researcher advisory exists on GitHub from Amalll-Sec, indicating the vulnerability has been analyzed and documented with reproduction steps. Impact is assessed as high availability loss; remote code execution has not been independently confirmed from available data but cannot be excluded given the CWE-121 class.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis.
Remote buffer overflow in the Totolink A3002MU router's boa web server allows authenticated network attackers to overflow a fixed-size buffer in the formIpv6Setup handler by supplying an oversized `static_ipv6` argument, potentially enabling arbitrary code execution with root privileges on the device. The vulnerability affects firmware version Hh-B20211125.1046 and a proof-of-concept exploit has been publicly disclosed to GitHub. No vendor-released patch has been identified in available references at time of analysis.
Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. No patch is available at time of analysis; the vulnerability carries a CVSS 4.0 score of 8.6 with subsequent-system impact metrics elevated due to the router's central network position.
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
Heap buffer overflow in MKVToolNix through 101.0 allows code execution when a victim processes a crafted AVI file with mkvmerge. The bundled avilib 0.6.10 library's ODML superindex parser performs 32-bit size arithmetic on attacker-controlled entry counts, producing an integer wraparound (CWE-680) that causes an undersized heap allocation; subsequent data writes overflow the buffer. An attacker who delivers a malicious AVI file and induces a user or automated pipeline to process it with mkvmerge can achieve arbitrary code execution with user-level privileges. No public exploit has been identified and no KEV listing exists, but a patch commit is available on Codeberg.
SIPp's get_header() parser function in versions through 3.7.7 is vulnerable to a classic CWE-120 stack buffer overflow triggered by SIP messages containing header content exceeding approximately 20,490 bytes. Any unauthenticated network peer reaching the SIPp listener can crash the process with a single crafted SIP packet; the CVSS 4.0 vector (VA:H, no C/I impact) and source code evidence confirm this is an availability-only impact with no confirmed code-execution path. The upstream fix (commit 8ddfb43, PR #881) replaces unbounded sprintf() calls with snprintf() bounds enforcement, but no official tagged release incorporating the fix has been confirmed at time of analysis.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in `call_get_attribute()` (src/sip_call.c) and `msg_get_attribute()` (src/sip_msg.c), where unbounded `sprintf` calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix commit is publicly accessible, making independent weaponization feasible.
Heap buffer overflow in Freeciv's worklist_load() function allows memory corruption when a crafted savegame file declares a worklist length exceeding the fixed MAX_LEN_WORKLIST bound of 64 entries. Both savegame format v2 (savegame2.c) and v3 (savegame3.c) code paths are vulnerable in all releases before 3.2.6, meaning any user or server operator who loads a malicious .sav file may have heap-adjacent struct fields overwritten, potentially enabling arbitrary code execution. No public exploit has been identified at time of analysis, but the patch diff is publicly available on GitHub, lowering the bar for future weaponization.
Heap buffer overflow in stb_vorbis through 1.22 allows remote attackers to crash or corrupt the heap of any application that parses attacker-supplied Ogg Vorbis audio. The root cause is an integer truncation bug in start_decoder() where the codebook multiplicands allocation size is computed as a size_t but narrowed to int before being passed to the allocator, enabling a heap undersizing condition triggerable by crafting codebook entries and dimensions values that overflow the int range. No public exploit code or active exploitation is confirmed, but the no-interaction network vector makes this impactful for any service that accepts Ogg Vorbis input from untrusted sources.
Out-of-bounds write in the Linux kernel AppArmor LSM label parser allows any local user on an AppArmor-loaded system to corrupt kernel heap or stack memory by writing a crafted multi-component label string to /proc/self/attr/apparmor/current or to the world-writable (mode 0666) securityfs .access file, the latter path applying no privilege check whatsoever. The bug is a deterministic off-by-one: aa_vec_unique() writes a NULL terminator at vec[n] when no duplicates are found, but vec_setup() and DEFINE_VEC() allocate only n slots, so the write lands one entry past the end of either the local stack array or the kzalloc'd buffer. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.
Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.
Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). It is only reachable when a CephFS mount is re-exported over NFS; fixed by the new ceph_export_copy_name() helper that rejects over-length names with -ENAMETOOLONG. No public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.
Out-of-bounds read in the Linux kernel CephFS client (fs/ceph/mdsmap.c) lets a malicious or compromised Ceph monitor crash a client that has a CephFS mount. ceph_mdsmap_decode() advances its decode cursor by num_export_targets*4 bytes for each per-MDS info record without verifying enough bytes remain, and the only runaway-cursor guard is skipped for info versions 2 and 3, so an oversized count walks the cursor past the message front buffer and a later ceph_decode_32() reads slab memory out of bounds. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Out-of-bounds heap read and write in the Linux kernel's CIFS/SMB client (coalesce_t2() in fs/smb/client) allows a malicious or MITM SMB server to corrupt kernel memory or leak data by supplying a crafted Transaction2 DataOffset field. The function computes source and target data pointers directly from the server-controlled DataOffset with no bounds validation before a memcpy, so a small value overwrites header fields while a large value pushes the pointer past the buffer end. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the fix adds lower- and upper-bound checks for both pointers.
Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. No public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
Out-of-bounds kernel memory write in Linux kernel BPF stack unwinding (`__bpf_get_stack`) exposes CONFIG_PREEMPT systems to local privilege escalation. On fully preemptible kernels, a non-sleepable BPF raw tracepoint program runs under `migrate_disable()` but not `preempt_disable()`, creating a scheduler preemption window between per-CPU callchain buffer release and consumer memcpy; a concurrent task can overwrite `trace->nr`, inflating `copy_len` past the caller's buffer boundary. The vulnerability affects Linux 4.18 through stable branches preceding 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit exists and EPSS is 0.17%, but the C:H/I:H/A:H impact ratings reflect kernel memory corruption potential.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
Integer overflow in the Linux kernel's libnvdimm label-validation path allows a local low-privileged attacker with access to NVDIMM configuration commands (or crafted DIMM media) to trigger an out-of-bounds write in nd_label_data_init(). The on-media u32 field nslot, multiplied by sizeof_namespace_label() in 32-bit arithmetic introduced as a regression in Linux 4.13 (commit 564e871aa66f), wraps modulo 2^32 before the bounds check, causing a downstream memset() to overrun the config buffer. No public exploit code has been identified, and EPSS sits at 0.20% (10th percentile), reflecting realistic limited exposure given the niche hardware requirement.
Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), placing this in the low-probability-of-exploitation tier despite a CVSS score of 7.8.
Out-of-bounds reads in the Linux kernel SUNRPC RPCSEC_GSS privacy (krb5p) receive path allow a malicious or compromised NFS server to crash or leak memory from a connecting client. The function gss_unwrap_resp_priv() validated the opaque token length with a single u32 addition (offset + opaque_len) and no lower bound, so a crafted reply with opaque_len near 0xffffffff wraps the sum below rcv_buf->len and passes the check, while any length below GSS_KRB5_TOK_HDR_LEN is forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4/ptr+6 then run past the token. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a config-gated, DoS-leaning memory-safety bug rather than a broadly weaponizable RCE.
Remote out-of-bounds read and general protection fault in the Linux kernel's svcrdma (RPC-over-RDMA server) code allows a connected RDMA client to crash the kernel by advertising a Write or Reply chunk with zero segments. The pcl_for_each_segment iteration macro computed an inclusive upper bound of &ch_segments[ch_segcount - 1]; with a u32 ch_segcount of 0 this underflows to 0xFFFFFFFF, walking far past the flex array until it faults when svc_rdma_get_inv_rkey() dereferences segment->rs_handle. Fixed upstream; EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis.
Out-of-bounds heap write in the Linux kernel's server-side RPC-over-RDMA transport (svcrdma), used by the in-kernel NFS server, allows a malicious RPC-over-RDMA client to corrupt slab memory. When a client requests a reply (such as an NFS READ payload) without supplying a Write list or Reply chunk, and that reply needs more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_reply_msg() linearizes the entire reply into the fixed sc_max_req_size buffer; because the reply size is bounded only by the client request, the copy runs past the buffer and the oversized length is also posted to the device. There is no public exploit identified at time of analysis, and EPSS is low (0.17%).
Integer overflow in RISC-V KVM's SBI PMU EVENT_GET_INFO handler allows a guest VM to trigger out-of-bounds heap reads and writes on the host kernel, with scope-changed impact (C:H/I:H/A:H). A malicious or compromised guest on a RISC-V host running KVM can supply a crafted num_events value (e.g., 0x10000001 on RV64) that overflows a 32-bit multiplication, causing under-allocation of the event-info array while the subsequent loop iterates over the original large count - resulting in slab-out-of-bounds memory corruption confirmed by KASAN traces. No public exploit code exists and EPSS is 0.15%, but the scope change to the host kernel makes this a VM-escape class finding for RISC-V KVM deployments.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.
Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.
Slab out-of-bounds read in the Linux kernel's ocfs2 filesystem lets a crafted on-disk image trigger memory disclosure once mounted. The indexed-directory validators ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signature but never bound the ocfs2_dx_entry_list de_num_used/de_count counts against the 4KB metadata block capacity, so ocfs2_dx_dir_search() walks up to 0xffff entries far past the block. Any path lookup, stat(), or open() on an indexed directory in a malicious image reads adjacent slab memory. EPSS is low (0.20%, 10th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Out-of-bounds heap write in the Linux kernel's XDP subsystem allows memory corruption when an AF_XDP zero-copy packet is redirected through cpumap. The xdp_convert_zc_to_xdp_frame() routine copies an XSK packet into an order-0 page but advertises the full PAGE_SIZE as usable and records zero headroom, letting the frame overrun the page tail reserved for skb_shared_info and triggering a KASAN slab-out-of-bounds write in skb_gro_receive during GRO processing. No public exploit identified at time of analysis and EPSS is low (0.17%); the vendor has released fixes across stable branches.
Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.
Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.