Buffer Overflow
Monthly
Denial-of-service attack vectors in OpenRGB's unauthenticated TCP network protocol server (listening on 0.0.0.0:6742) allow any network-reachable attacker to crash or resource-exhaust the OpenRGB daemon without authentication. CVE-2026-18794 covers multiple DoS paths rooted in absent input-size validation - the server performs uncapped memory allocations from attacker-controlled length fields and passes raw network data to string constructors without null-termination checks. A Python reproducer script was published alongside coordinated disclosure on 2026-08-25, lowering the exploitation bar significantly. No CISA KEV listing; upstream 1.0rc3-hotfix addresses the worst aspects of the disclosed flaw set.
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.
Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute arbitrary code within the process context of the application. Exploitation requires a victim to open a specially crafted FLT (OpenFlight) file, placing this firmly in the file-borne, socially engineered delivery category. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation.
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of the current user process when a victim opens a maliciously crafted ABC file. The vulnerability carries a CVSS 7.8 High score with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the combination of low attack complexity and full process-context code execution potential makes this a credible risk for 3ds Max users who routinely open externally sourced scene files.
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. EPSS stands at 0.25% (16th percentile) with SSVC exploitation status of 'none,' indicating no current active exploitation; however, the RCE-capable impact triad warrants patching in affected professional environments.
Out-of-bounds read in SpaceDot AcubeSAT On-Board Computer software exposes the spacecraft's CAN bus message handler to denial-of-service attacks. An attacker with access to the CAN bus network can send a crafted PerformFunction message to the OBC, triggering an out-of-bounds read in the CAN::Application::parsePerformFunctionMessage component that crashes the on-board computer. No public exploit identified at time of analysis, and EPSS exploitation probability sits at 0.14% (4th percentile), consistent with a highly specialized embedded aerospace target.
Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.
Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.
Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.
Buffer overflow in DrayTek VigorSwitch web management interface allows authenticated remote administrators to cause denial of service or potentially execute arbitrary commands on affected managed switches. The flaw resides in the acl_general_setup Edit ACE function, where the name field is copied into a fixed-size stack buffer without length validation (CWE-120). No public exploit code has been identified at time of analysis, and exploitation is gated behind valid administrative credentials, meaningfully reducing the attack surface compared to unauthenticated network flaws.
Buffer overflow in DrayTek VigorSwitch's ACL configuration function exposes authenticated administrators to denial of service or potential arbitrary command execution via the device's web management interface. The root cause - an unbounded strcpy-style copy of a user-supplied name field into a fixed-size stack or heap buffer inside acl_general_setup's Add ACE handler - is a classic CWE-120 defect reachable over the network from any host with management-plane access. Exploitation requires valid administrative credentials (CVSS PR:H), substantially limiting the attack surface; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Buffer overflow in DrayTek VigorSwitch's switch_lan_gvrp function exposes multiple managed switch models to denial of service or potential arbitrary command execution from remote, authenticated attackers. The flaw stems from unsafe copying of a user-supplied portList field into an undersized stack or heap buffer within the GVRP handling code - a classic CWE-120 defect reachable via the device's web management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and exploitation is gated behind valid administrative credentials, which meaningfully constrains real-world attacker opportunity.
Buffer overflow in DrayTek VigorSwitch's PoE schedule profile function allows authenticated remote administrators to cause denial of service or execute arbitrary commands on affected network switches. The flaw spans at least 10 CPE-confirmed models and an even wider set per VulnCheck tags, covering much of the VigorSwitch product line. No public exploit code and no CISA KEV listing have been identified at time of analysis, but DrayTek has published a security advisory acknowledging the issue.
Buffer overflow in the sysreboot function of multiple DrayTek VigorSwitch managed switch models allows authenticated remote attackers to cause denial of service or execute arbitrary commands. The root cause (CWE-120) is unsafe concatenation of split valueN attacker-controlled data into a fixed-size buffer in the device's web management firmware, exploitable over the network by any party holding valid administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in DrayTek VigorSwitch's webBackupAction function enables authenticated administrators to trigger denial of service or arbitrary code execution by submitting crafted HTTP requests with excessively long pathN, valueN, key, and option parameters. Exploitation is gated behind valid administrative credentials (CVSS PR:H), limiting direct internet exposure but creating meaningful risk via compromised admin accounts or insider threats. No public exploit identified at time of analysis and no CISA KEV listing, though the CWE-120 root cause class is well-understood and device-accessible researchers could feasibly develop working exploits.
Buffer overflow in DrayTek VigorSwitch's pingtrace diagnostic function allows authenticated remote attackers to cause denial of service or achieve arbitrary command execution across a broad range of VigorSwitch hardware models. The flaw arises from absent length validation when user-supplied host, count, and interval parameters are concatenated into a statically allocated buffer in the web management firmware. No public exploit is identified at time of analysis, and exploitation is gated behind valid administrative credentials, but the severity of achievable impact - full device compromise - warrants prompt patching on any network where VigorSwitch units are deployed.
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. No public exploit code has been identified at time of analysis, the vulnerability is absent from CISA KEV, and a vendor-released patch is confirmed available via DrayTek's August 2026 security advisory.
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote attackers to cause denial of service or execute arbitrary commands on affected devices. Six distinct VigorAP models - 903, 906, 912C, 918R, 960C, and 1060C - are confirmed affected across specific firmware version ranges, all patched by DrayTek in an August 2026 advisory. No public exploit identified at time of analysis, though the vulnerability was independently reported by VulnCheck and the impact class (RCE and DoS) raises operational risk for any organization where VigorAP admin interfaces are reachable from untrusted networks.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.
Remote code execution in Konami's Metal Gear Online 3 (build 1.1.2.8) arises from an unbounded heap write when parsing the lobby's kicked-player list: the game trusts the attacker-supplied "kick_num" count without checking it against the 16-player buffer limit. A malicious lobby participant can overflow the kicked-ID buffer into adjacent Steam callback handler structures, corrupting function pointers to hijack control flow and potentially execute arbitrary code inside the game process. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-reachable, unauthenticated nature and RCE potential make it high-severity.
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-service condition against the connector process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assigns High confidentiality and integrity impact, creating a notable discrepancy with the vendor description, which characterizes impact as DoS only - this gap suggests the vulnerability may carry latent code-execution potential that the description does not fully disclose. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
Remote buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows network-reachable authenticated attackers to corrupt memory by supplying an oversized SSID value to the /goform/formConfigFastDirectionW endpoint, which calls strcpy without bounds checking on user input. Full confidentiality, integrity, and availability impact on the device is possible, potentially enabling arbitrary code execution and pivoting into the network behind the gateway. A public proof-of-concept exploit is available on GitHub; no active exploitation has been confirmed in CISA KEV at time of analysis.
Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Heap out-of-bounds write in DBD::Pg 3.21.0, the Perl DBI driver for PostgreSQL, lets an attacker corrupt heap memory by passing special floating-point literals (NaN, Inf, +Inf, -Inf, Infinity, and signed variants) to the quote_float() routine, reachable through the common $dbh->quote(value, DBI::SQL_NUMERIC) path. The bug is a 2-byte overwrite (a single quote plus a NULL terminator) introduced by the 3.21.0 quote.c rewrite and fixed in 3.21.1. No public exploit identified at time of analysis; EPSS is low (0.23%, 14th percentile) and CISA SSVC records exploitation status as none.
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
Out-of-bounds write in the Linux kernel's IPVS subsystem (`ip_vs_nat_icmp`) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (`ihl`), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). An attacker achieving kernel memory corruption via this path could escalate privileges to full kernel control; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). Despite an input CVSS of 9.8 (network vector), the actual defect requires local mounting/reading of an attacker-crafted image, making it a local availability/disclosure issue rather than remote code execution.
Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV.
Type confusion in the Linux kernel's PMBus hardware monitor driver (`pmbus_notify()`) enables a slab-out-of-bounds read and potential kernel memory corruption on systems with PMBus-capable power management hardware. The `pmbus_notify()` loop unconditionally casts all attribute pointers to `struct sensor_device_attribute`, but the attribute array also contains `struct pmbus_samples_reg` and `struct pmbus_sensor` objects that only embed a base `struct device_attribute`; reading the `index` field of these miscast pointers accesses memory beyond the allocation or overlaps with unrelated kernel struct fields, producing garbage masks that could spuriously match alert conditions. No public exploit has been identified and EPSS is low (0.21%, 11th percentile), but the theoretical impact is full kernel privilege escalation on affected hardware.
Slab-out-of-bounds read in the Linux kernel's ATM subsystem `vcc_setsockopt()` exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched `level` parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to `copy_from_sockptr()` reading beyond the supplied buffer. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, reflecting low real-world exploitation probability against a legacy subsystem.
Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), consistent with a subsystem-specific memory-corruption bug rather than a mass-exploitation candidate.
Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. No public exploit has been identified and no CISA KEV listing exists; patches are available across at least eight stable kernel branches.
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.
Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.
Heap out-of-bounds write in LibVNCClient 0.9.12-0.9.15 allows a malicious or man-in-the-middle VNC server to corrupt client heap memory with attacker-controlled data, leading to unconditional denial of service or demonstrated remote code execution via callback pointer overwrite. The flaw fires from a single FramebufferUpdate message the moment a victim connects, requires no authentication, and works against default builds with default settings. No public exploit has been identified at time of analysis, though the GitHub Security Advisory explicitly demonstrates code execution under default configuration.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).
Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.
Out-of-bounds read and one-byte out-of-bounds write in mod_auth_openidc's state-cookie parser (all versions prior to 2.4.19.4) allow unauthenticated remote attackers to crash Apache worker processes by sending a malformed Cookie header. The root cause is a loop termination condition in src/state.c that checked whether a pointer was NULL — a condition that could never fire since the pointer is only ever incremented — rather than checking for the string terminator, causing state-prefixed cookie tokens lacking '=' to scan and write past the end of the token buffer. No CISA KEV listing or confirmed public exploit exists at time of analysis, but the CVSS AV:N/AC:L/PR:N profile and the fully transparent fix commit make this trivially automatable for denial-of-service once widely known.
Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.
Stack memory corruption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote denial of service by crashing the host kernel through a crafted IPsec ESP packet. The flaw (CWE-908: Use of Uninitialized Resource) resides in the ESP decapsulation handler, where uninitialized stack memory can be corrupted before proper validation, causing a system panic. No active exploitation is confirmed (absent from CISA KEV) and EPSS stands at 0.32%, but the PowerVM VIOS attack surface carries an amplified blast radius: a VIOS crash disrupts I/O services for all co-hosted logical partitions simultaneously.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated exploitation, and IBM PSIRT has published a support advisory. There is no public exploit identified at time of analysis, EPSS is modest (0.61%, 47th percentile), and CISA SSVC rates exploitation as 'none' with technical impact 'total'.
Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise of the affected Unix host or virtualization I/O server. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.41%, 35th percentile), with CISA SSVC recording no observed exploitation.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger over the network without authentication or user interaction. Per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the flaw is critical (9.8) with total confidentiality, integrity, and availability impact, though the description does not name the specific network service or daemon that parses the malformed input. There is no public exploit identified at time of analysis, and EPSS is low (0.41%, 35th percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.
Out-of-bounds read in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive memory contents and enables denial of service against affected systems. The flaw is reachable by remote attackers according to the vendor description, enabling both unauthorized information disclosure and availability disruption without authentication. No public exploit code or active exploitation has been identified at time of analysis, though the high CVSS score and dual-impact (C:H, A:H) profile elevate priority for affected IBM UNIX and virtualization environments.
Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.
Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.
Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that lets a remote attacker overwrite memory and run arbitrary code on the host. IBM PSIRT rated it CVSS 9.8, and the vector indicates network-reachable, unauthenticated exploitation requiring no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE on an enterprise Unix platform makes it a high-priority patch.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger without authentication or user interaction, yielding full compromise of the affected system. IBM PSIRT rates it CVSS 9.8, reflecting complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 arises from a stack-based buffer overflow (CWE-121) that a remote attacker can trigger without authentication or user interaction, yielding total compromise of these Power-based enterprise Unix and virtualization-management systems. The CVSS 9.8 rating reflects a fully remote, low-complexity path to arbitrary code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low (0.61%, 47th percentile), indicating no observed widespread exploitation yet despite the critical severity.
Local arbitrary code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from an out-of-bounds read (CWE-125) exploitable by a low-privileged local user with no user interaction required. A successful attacker achieves full confidentiality, integrity, and availability compromise of the affected system, as reflected in the CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity makes this a credible local privilege escalation path on POWER-architecture infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a classic buffer overflow (CWE-120). The flaw carries a CVSS 9.8 with a network, no-authentication, no-interaction vector, meaning a successful exploit yields full compromise of the affected Unix host. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but a vendor patch is available.
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.
Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.
Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.
Heap buffer overflow in Capstone's SuperH (SH) architecture floating-point disassembler affects all releases through 6.0.0-Alpha9, allowing a four-byte out-of-bounds write into heap memory when processing crafted SH instructions. The root cause is that opFADD, opFMUL, opFSUB, and related SH FPU decoders in arch/SH/SHDisassembler.c increment op_count as an array index into the fixed-size operands[] array without bounds checking, overflowing the 176-byte sh_info heap allocation. A process that disassembles attacker-controlled SH binary data with the affected mode flags can be crashed; code execution is possible but depends on heap layout. No public exploit has been identified at time of analysis, though a proof-of-concept test case is included in the upstream fix PR. The vendor-released patch is version 6.0.0-Alpha10.
Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.
Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.
Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is confirmed in v8.18.3.
Remote unauthenticated code execution is possible in swift-nio-ssh, Apple's Swift implementation of the SSH2 protocol built on SwiftNIO, where a single crafted SSH message triggers an out-of-bounds stack write of attacker-controlled length and content. Any server or client application built on swift-nio-ssh before 0.14.1 is affected, and an attacker can corrupt stack memory pre-authentication to potentially achieve arbitrary code execution. No public exploit identified at time of analysis, and despite the maximal 9.8 CVSS the EPSS probability is currently low (0.14%, 4th percentile).
Denial-of-service attack vectors in OpenRGB's unauthenticated TCP network protocol server (listening on 0.0.0.0:6742) allow any network-reachable attacker to crash or resource-exhaust the OpenRGB daemon without authentication. CVE-2026-18794 covers multiple DoS paths rooted in absent input-size validation - the server performs uncapped memory allocations from attacker-controlled length fields and passes raw network data to string constructors without null-termination checks. A Python reproducer script was published alongside coordinated disclosure on 2026-08-25, lowering the exploitation bar significantly. No CISA KEV listing; upstream 1.0rc3-hotfix addresses the worst aspects of the disclosed flaw set.
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.
Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute arbitrary code within the process context of the application. Exploitation requires a victim to open a specially crafted FLT (OpenFlight) file, placing this firmly in the file-borne, socially engineered delivery category. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation.
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of the current user process when a victim opens a maliciously crafted ABC file. The vulnerability carries a CVSS 7.8 High score with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the combination of low attack complexity and full process-context code execution potential makes this a credible risk for 3ds Max users who routinely open externally sourced scene files.
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. EPSS stands at 0.25% (16th percentile) with SSVC exploitation status of 'none,' indicating no current active exploitation; however, the RCE-capable impact triad warrants patching in affected professional environments.
Out-of-bounds read in SpaceDot AcubeSAT On-Board Computer software exposes the spacecraft's CAN bus message handler to denial-of-service attacks. An attacker with access to the CAN bus network can send a crafted PerformFunction message to the OBC, triggering an out-of-bounds read in the CAN::Application::parsePerformFunctionMessage component that crashes the on-board computer. No public exploit identified at time of analysis, and EPSS exploitation probability sits at 0.14% (4th percentile), consistent with a highly specialized embedded aerospace target.
Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.
Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.
Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.
Buffer overflow in DrayTek VigorSwitch web management interface allows authenticated remote administrators to cause denial of service or potentially execute arbitrary commands on affected managed switches. The flaw resides in the acl_general_setup Edit ACE function, where the name field is copied into a fixed-size stack buffer without length validation (CWE-120). No public exploit code has been identified at time of analysis, and exploitation is gated behind valid administrative credentials, meaningfully reducing the attack surface compared to unauthenticated network flaws.
Buffer overflow in DrayTek VigorSwitch's ACL configuration function exposes authenticated administrators to denial of service or potential arbitrary command execution via the device's web management interface. The root cause - an unbounded strcpy-style copy of a user-supplied name field into a fixed-size stack or heap buffer inside acl_general_setup's Add ACE handler - is a classic CWE-120 defect reachable over the network from any host with management-plane access. Exploitation requires valid administrative credentials (CVSS PR:H), substantially limiting the attack surface; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Buffer overflow in DrayTek VigorSwitch's switch_lan_gvrp function exposes multiple managed switch models to denial of service or potential arbitrary command execution from remote, authenticated attackers. The flaw stems from unsafe copying of a user-supplied portList field into an undersized stack or heap buffer within the GVRP handling code - a classic CWE-120 defect reachable via the device's web management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and exploitation is gated behind valid administrative credentials, which meaningfully constrains real-world attacker opportunity.
Buffer overflow in DrayTek VigorSwitch's PoE schedule profile function allows authenticated remote administrators to cause denial of service or execute arbitrary commands on affected network switches. The flaw spans at least 10 CPE-confirmed models and an even wider set per VulnCheck tags, covering much of the VigorSwitch product line. No public exploit code and no CISA KEV listing have been identified at time of analysis, but DrayTek has published a security advisory acknowledging the issue.
Buffer overflow in the sysreboot function of multiple DrayTek VigorSwitch managed switch models allows authenticated remote attackers to cause denial of service or execute arbitrary commands. The root cause (CWE-120) is unsafe concatenation of split valueN attacker-controlled data into a fixed-size buffer in the device's web management firmware, exploitable over the network by any party holding valid administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in DrayTek VigorSwitch's webBackupAction function enables authenticated administrators to trigger denial of service or arbitrary code execution by submitting crafted HTTP requests with excessively long pathN, valueN, key, and option parameters. Exploitation is gated behind valid administrative credentials (CVSS PR:H), limiting direct internet exposure but creating meaningful risk via compromised admin accounts or insider threats. No public exploit identified at time of analysis and no CISA KEV listing, though the CWE-120 root cause class is well-understood and device-accessible researchers could feasibly develop working exploits.
Buffer overflow in DrayTek VigorSwitch's pingtrace diagnostic function allows authenticated remote attackers to cause denial of service or achieve arbitrary command execution across a broad range of VigorSwitch hardware models. The flaw arises from absent length validation when user-supplied host, count, and interval parameters are concatenated into a statically allocated buffer in the web management firmware. No public exploit is identified at time of analysis, and exploitation is gated behind valid administrative credentials, but the severity of achievable impact - full device compromise - warrants prompt patching on any network where VigorSwitch units are deployed.
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. No public exploit code has been identified at time of analysis, the vulnerability is absent from CISA KEV, and a vendor-released patch is confirmed available via DrayTek's August 2026 security advisory.
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote attackers to cause denial of service or execute arbitrary commands on affected devices. Six distinct VigorAP models - 903, 906, 912C, 918R, 960C, and 1060C - are confirmed affected across specific firmware version ranges, all patched by DrayTek in an August 2026 advisory. No public exploit identified at time of analysis, though the vulnerability was independently reported by VulnCheck and the impact class (RCE and DoS) raises operational risk for any organization where VigorAP admin interfaces are reachable from untrusted networks.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.
Remote code execution in Konami's Metal Gear Online 3 (build 1.1.2.8) arises from an unbounded heap write when parsing the lobby's kicked-player list: the game trusts the attacker-supplied "kick_num" count without checking it against the 16-player buffer limit. A malicious lobby participant can overflow the kicked-ID buffer into adjacent Steam callback handler structures, corrupting function pointers to hijack control flow and potentially execute arbitrary code inside the game process. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-reachable, unauthenticated nature and RCE potential make it high-severity.
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-service condition against the connector process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assigns High confidentiality and integrity impact, creating a notable discrepancy with the vendor description, which characterizes impact as DoS only - this gap suggests the vulnerability may carry latent code-execution potential that the description does not fully disclose. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
Remote buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows network-reachable authenticated attackers to corrupt memory by supplying an oversized SSID value to the /goform/formConfigFastDirectionW endpoint, which calls strcpy without bounds checking on user input. Full confidentiality, integrity, and availability impact on the device is possible, potentially enabling arbitrary code execution and pivoting into the network behind the gateway. A public proof-of-concept exploit is available on GitHub; no active exploitation has been confirmed in CISA KEV at time of analysis.
Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Heap out-of-bounds write in DBD::Pg 3.21.0, the Perl DBI driver for PostgreSQL, lets an attacker corrupt heap memory by passing special floating-point literals (NaN, Inf, +Inf, -Inf, Infinity, and signed variants) to the quote_float() routine, reachable through the common $dbh->quote(value, DBI::SQL_NUMERIC) path. The bug is a 2-byte overwrite (a single quote plus a NULL terminator) introduced by the 3.21.0 quote.c rewrite and fixed in 3.21.1. No public exploit identified at time of analysis; EPSS is low (0.23%, 14th percentile) and CISA SSVC records exploitation status as none.
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
Out-of-bounds write in the Linux kernel's IPVS subsystem (`ip_vs_nat_icmp`) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (`ihl`), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). An attacker achieving kernel memory corruption via this path could escalate privileges to full kernel control; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). Despite an input CVSS of 9.8 (network vector), the actual defect requires local mounting/reading of an attacker-crafted image, making it a local availability/disclosure issue rather than remote code execution.
Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV.
Type confusion in the Linux kernel's PMBus hardware monitor driver (`pmbus_notify()`) enables a slab-out-of-bounds read and potential kernel memory corruption on systems with PMBus-capable power management hardware. The `pmbus_notify()` loop unconditionally casts all attribute pointers to `struct sensor_device_attribute`, but the attribute array also contains `struct pmbus_samples_reg` and `struct pmbus_sensor` objects that only embed a base `struct device_attribute`; reading the `index` field of these miscast pointers accesses memory beyond the allocation or overlaps with unrelated kernel struct fields, producing garbage masks that could spuriously match alert conditions. No public exploit has been identified and EPSS is low (0.21%, 11th percentile), but the theoretical impact is full kernel privilege escalation on affected hardware.
Slab-out-of-bounds read in the Linux kernel's ATM subsystem `vcc_setsockopt()` exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched `level` parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to `copy_from_sockptr()` reading beyond the supplied buffer. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, reflecting low real-world exploitation probability against a legacy subsystem.
Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), consistent with a subsystem-specific memory-corruption bug rather than a mass-exploitation candidate.
Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. No public exploit has been identified and no CISA KEV listing exists; patches are available across at least eight stable kernel branches.
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.
Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.
Heap out-of-bounds write in LibVNCClient 0.9.12-0.9.15 allows a malicious or man-in-the-middle VNC server to corrupt client heap memory with attacker-controlled data, leading to unconditional denial of service or demonstrated remote code execution via callback pointer overwrite. The flaw fires from a single FramebufferUpdate message the moment a victim connects, requires no authentication, and works against default builds with default settings. No public exploit has been identified at time of analysis, though the GitHub Security Advisory explicitly demonstrates code execution under default configuration.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).
Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.
Out-of-bounds read and one-byte out-of-bounds write in mod_auth_openidc's state-cookie parser (all versions prior to 2.4.19.4) allow unauthenticated remote attackers to crash Apache worker processes by sending a malformed Cookie header. The root cause is a loop termination condition in src/state.c that checked whether a pointer was NULL — a condition that could never fire since the pointer is only ever incremented — rather than checking for the string terminator, causing state-prefixed cookie tokens lacking '=' to scan and write past the end of the token buffer. No CISA KEV listing or confirmed public exploit exists at time of analysis, but the CVSS AV:N/AC:L/PR:N profile and the fully transparent fix commit make this trivially automatable for denial-of-service once widely known.
Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.
Stack memory corruption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote denial of service by crashing the host kernel through a crafted IPsec ESP packet. The flaw (CWE-908: Use of Uninitialized Resource) resides in the ESP decapsulation handler, where uninitialized stack memory can be corrupted before proper validation, causing a system panic. No active exploitation is confirmed (absent from CISA KEV) and EPSS stands at 0.32%, but the PowerVM VIOS attack surface carries an amplified blast radius: a VIOS crash disrupts I/O services for all co-hosted logical partitions simultaneously.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated exploitation, and IBM PSIRT has published a support advisory. There is no public exploit identified at time of analysis, EPSS is modest (0.61%, 47th percentile), and CISA SSVC rates exploitation as 'none' with technical impact 'total'.
Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise of the affected Unix host or virtualization I/O server. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.41%, 35th percentile), with CISA SSVC recording no observed exploitation.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger over the network without authentication or user interaction. Per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the flaw is critical (9.8) with total confidentiality, integrity, and availability impact, though the description does not name the specific network service or daemon that parses the malformed input. There is no public exploit identified at time of analysis, and EPSS is low (0.41%, 35th percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.
Out-of-bounds read in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive memory contents and enables denial of service against affected systems. The flaw is reachable by remote attackers according to the vendor description, enabling both unauthorized information disclosure and availability disruption without authentication. No public exploit code or active exploitation has been identified at time of analysis, though the high CVSS score and dual-impact (C:H, A:H) profile elevate priority for affected IBM UNIX and virtualization environments.
Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.
Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.
Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that lets a remote attacker overwrite memory and run arbitrary code on the host. IBM PSIRT rated it CVSS 9.8, and the vector indicates network-reachable, unauthenticated exploitation requiring no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE on an enterprise Unix platform makes it a high-priority patch.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger without authentication or user interaction, yielding full compromise of the affected system. IBM PSIRT rates it CVSS 9.8, reflecting complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 arises from a stack-based buffer overflow (CWE-121) that a remote attacker can trigger without authentication or user interaction, yielding total compromise of these Power-based enterprise Unix and virtualization-management systems. The CVSS 9.8 rating reflects a fully remote, low-complexity path to arbitrary code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low (0.61%, 47th percentile), indicating no observed widespread exploitation yet despite the critical severity.
Local arbitrary code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from an out-of-bounds read (CWE-125) exploitable by a low-privileged local user with no user interaction required. A successful attacker achieves full confidentiality, integrity, and availability compromise of the affected system, as reflected in the CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity makes this a credible local privilege escalation path on POWER-architecture infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a classic buffer overflow (CWE-120). The flaw carries a CVSS 9.8 with a network, no-authentication, no-interaction vector, meaning a successful exploit yields full compromise of the affected Unix host. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but a vendor patch is available.
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.
Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.
Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.
Heap buffer overflow in Capstone's SuperH (SH) architecture floating-point disassembler affects all releases through 6.0.0-Alpha9, allowing a four-byte out-of-bounds write into heap memory when processing crafted SH instructions. The root cause is that opFADD, opFMUL, opFSUB, and related SH FPU decoders in arch/SH/SHDisassembler.c increment op_count as an array index into the fixed-size operands[] array without bounds checking, overflowing the 176-byte sh_info heap allocation. A process that disassembles attacker-controlled SH binary data with the affected mode flags can be crashed; code execution is possible but depends on heap layout. No public exploit has been identified at time of analysis, though a proof-of-concept test case is included in the upstream fix PR. The vendor-released patch is version 6.0.0-Alpha10.
Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.
Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.
Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is confirmed in v8.18.3.
Remote unauthenticated code execution is possible in swift-nio-ssh, Apple's Swift implementation of the SSH2 protocol built on SwiftNIO, where a single crafted SSH message triggers an out-of-bounds stack write of attacker-controlled length and content. Any server or client application built on swift-nio-ssh before 0.14.1 is affected, and an attacker can corrupt stack memory pre-authentication to potentially achieve arbitrary code execution. No public exploit identified at time of analysis, and despite the maximal 9.8 CVSS the EPSS probability is currently low (0.14%, 4th percentile).