Buffer Overflow
Monthly
Stack-based buffer overflow in UTT HiPER 1200GW firmware through version 2.5.3-170306 enables remote code execution via a crafted timestart parameter submitted to the /goform/formGroupConfig endpoint. The root cause is an unbounded strcpy() call (CWE-121) in the formGroupConfig handler that overwrites stack memory without validating input length. A public proof-of-concept exploit has been published to GitHub, and the CVSS 4.0 score of 8.6 with high impact across both the vulnerable device and subsequent network systems underscores the potential for network-wide compromise through this gateway appliance.
Stack-based buffer overflow in TRENDnet TEW-823DRU firmware 1.1.02b01 allows authenticated remote attackers to overwrite stack memory and achieve arbitrary code execution by supplying an oversized value to the `wan_l2tp_password` parameter processed by `/cgi-bin/wan.cgi`. The vulnerability stems from an unbounded `strcpy()` call in the NVRAM handling component, with no input length validation applied before the copy. A public proof-of-concept exploit script is available on GitHub, substantially lowering the bar for opportunistic exploitation against any reachable management interface.
Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's WebGL implementation (all versions prior to 151.0.7922.169) enables a remote attacker to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The sandbox escape elevates the impact from renderer-level code execution to potential full OS-level compromise. No public exploit code or active exploitation has been identified at the time of analysis, but the SSVC technical impact rating is 'total,' reflecting the severity of successful exploitation.
Stack-based buffer overflow in the alphapd web server daemon of TRENDnet TV-IP751WIC firmware 11.03.03 allows low-privileged remote attackers to execute arbitrary code by sending malformed input to any of seven vulnerable configuration-handling functions. Seven distinct code paths - SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, websCheckRealm, FUN_00432574, and FUN_0043372C - copy user-supplied configuration values onto the stack without enforcing length limits. A public proof-of-concept exploit has been published on GitHub, and the CVSS 4.0 score of 8.6 with E:P reflects meaningfully elevated exploitation risk even absent CISA KEV listing.
Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. A public proof-of-concept exploit exists, no public exploit identified as confirmed active exploitation (no CISA KEV listing), and no vendor patch has been confirmed at time of analysis.
Out-of-bounds read with unbounded memory allocation in the surfio Python/C++ library affects all versions prior to 0.0.19, where the Irap ASCII and binary surface-file parsers trust attacker-controllable ncol/nrow size fields in the header without validating them against the actual input length. A remote attacker who can supply a crafted .irap file to an application that parses it - the vendor explicitly rates severity assuming surfio runs in a networked service - can trigger a memory over-read and force allocation of tens of megabytes from a single tiny value, causing information disclosure or denial of service. No public exploit identified at time of analysis; the issue is fixed in 0.0.19.
Memory-corruption in Equinor's resdata library before 6.2.9 lets a crafted GRDECL reservoir-model file trigger a classic buffer overflow, out-of-bounds read, improper array indexing, and NULL-pointer dereference during parsing. Any application that feeds untrusted GRDECL input to resdata - the maintainer explicitly rates the 9.8 severity for a networked webservice that parses attacker-supplied files - is exposed to memory corruption that can lead to crashes, information disclosure, or potentially code execution. No public exploit identified at time of analysis, and the flaw is not on CISA KEV.
Buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux enables an unauthenticated attacker with Layer 2 network adjacency to achieve code execution by sending specially crafted LLDP frames. Both the GA track (all versions through 5.16) and LTS track (through 5.11.5 and 5.9.5 respectively) are confirmed affected. No active exploitation or public proof-of-concept code has been identified at time of analysis, though CISA SSVC rates the technical impact as total given that a successful exploit yields full switch compromise.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate.
Stack-based buffer overflow in the DHCP blobmsg handler within /sbin/netifd on TRENDnet TEW-WLC100P firmware 12.07b01 allows unauthenticated adjacent-network attackers to execute arbitrary code with no user interaction required. A working proof-of-concept Python exploit script has been publicly released on GitHub, materially lowering the skill threshold for exploitation. No CISA KEV listing exists at time of analysis and no vendor patch has been identified, leaving affected devices exposed with only network-level compensating controls available.
Memory-safety defects in Mozilla Firefox 153 could allow remote attackers to corrupt memory and potentially achieve arbitrary code execution when a victim renders malicious web content, and were resolved in Firefox 154. These bugs were discovered internally by Mozilla with no public exploit identified at time of analysis, and the EPSS exploitation probability is low (0.15%, 5th percentile). The issues are classified as buffer/memory-corruption defects (CWE-119) that Mozilla presumes could have been exploited with sufficient effort.
Memory-corruption defects in Mozilla Firefox 153 and Firefox ESR 153.0, disclosed by Mozilla in advisories MFSA2026-74/77/78/80, could allow a remote attacker to corrupt memory and potentially achieve arbitrary code execution within the browser process. The issues were found internally by Mozilla developers and fixed in Firefox 154 and Firefox ESR 153.1. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with a proactively-patched roll-up of memory-safety bugs rather than an actively exploited flaw.
Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1.
Memory corruption in Mozilla Firefox 153, Firefox ESR 153.0, and Firefox ESR 140.13 allows remote attackers to potentially execute arbitrary code within the browser process when a victim renders attacker-controlled web content. Mozilla internally discovered a batch of memory-safety defects (tracked across advisories MFSA2026-74 through MFSA2026-80) and states that some showed evidence of memory corruption presumed exploitable with sufficient effort. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Remote code execution in Systerel S2OPC 1.7.3 arises from a heap out-of-bounds write in the server-side EventFilter handling path exercised during CreateMonitoredItems processing. A remote attacker who can reach the OPC UA server endpoint and open a session on an events-enabled server can corrupt heap memory to achieve arbitrary code execution with the privileges of the server process. No public exploit identified at time of analysis, and EPSS is low (0.27%, 20th percentile), indicating the CVSS 9.8 rating reflects potential impact rather than observed mass exploitation.
Memory corruption in Apple's web content rendering engine affects iOS, iPadOS, and macOS Tahoe, enabling high-impact device compromise when a user processes maliciously crafted web content. All iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe versions prior to 26.6.2, are confirmed affected per Apple security advisories and EUVD-2026-60510. Apple has released patched builds across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Deskflow clients prior to continuous build 1.26.0.299 allows a network-reachable malicious server to crash the connected client or disclose up to four bytes of client process memory at an attacker-controlled relative offset. The flaw lives in ServerProxy::setOptions(), where crafted kMsgDSetOptions (DSOP) option values corrupt m_modifierTranslationTable indexes that translateKey() and translateModifierMask() then use to index static seven-row lookup arrays beyond their valid bounds. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no client-side user interaction beyond an established server connection.
Out-of-bounds read in Deskflow's client-side `ServerProxy::setOptions()` allows a malicious Deskflow server to crash any connected client by sending an odd-length DSOP options vector during the handshake sequence. Affected releases span from 1.17.0 through all continuous builds before 1.26.0.296, covering the full client codebase across five source files. No active exploitation is listed in CISA KEV and no public exploit code has been identified, though the crash is deterministic and the CVSS C:L component reflects marginal heap/stack memory disclosure from the out-of-bounds read.
Stack-based buffer overflow in Notepad++ before version 8.9.7 enables local code execution or process termination through the Run Dialog's variable expansion routine. The `expandNppEnvironmentStrs` function copies Notepad++ variable names from `$(...)` syntax into a fixed-size `wchar_t str[MAX_PATH]` stack buffer without bounding the loop index `m`, allowing any variable name of 260 or more wide characters to corrupt adjacent stack memory and trigger `__report_gsfailure` or, with precise crafting, execute arbitrary code. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. Proof-of-concept exploit code exists (CVSS 4.0 E:P), elevating real-world risk, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Out-of-bounds heap read in TIER IV Nebula's Vlp32Decoder::unpack() function through version 1.2.0 enables unauthenticated remote attackers to inject fabricated LiDAR point data into autonomous vehicle perception pipelines by sending short malformed UDP datagrams to the Velodyne sensor port. Unlike other Nebula sensor drivers, the VLP-32 UDP listener enforces no sender-address restrictions, making any network-reachable host a valid attacker origin without spoofing. Fabricated points derived from adjacent heap memory contents are silently published into downstream PointCloud2 messages consumed by Autoware nodes, creating a sensor-integrity risk with direct safety implications; no public exploit code and no CISA KEV listing are identified at time of analysis.
Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Out-of-bounds heap read in Belledonne Communications bcg729 through 1.1.2 allows unauthenticated network-adjacent attackers to crash the media process or silently corrupt G.729 comfort-noise generation by delivering a single zero-length SID RTP payload. The root cause is an integer underflow in uint8_t arithmetic inside decodeSIDframe() that causes the function to unconditionally attempt reading 11 bytes from a zero-byte heap buffer, resulting in media process termination or consumption of adjacent heap memory as LP filter reflection coefficients. No public exploit identified at time of analysis, but the trigger condition - one malformed RTP packet - represents a trivially low technical barrier for any attacker already on the RTP session path.
Remote unauthenticated denial-of-service in INDI indiserver through 2.2.4.2 allows any attacker with TCP access to port 7624 to crash the daemon with a single malformed packet. The vulnerability stems from an unbounded sprintf() call writing XML error messages into a fixed 1024-byte stack buffer in MsgQueue.cpp - sending mismatched XML tags whose names exceed that boundary overflows the stack frame and terminates the process, immediately disconnecting all active astronomical instrument drivers and client sessions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack primitive is trivially constructible given the deterministic overflow path confirmed in the patch diff.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Financial fraud via integer overflow in QuantumNous New API (an LLM gateway and AI asset-management platform) lets a low-privileged account with a positive balance or active subscription manipulate user-controlled billing multipliers so that a computed charge wraps into account credit and can drain upstream provider funds. The flaw sits in quota settlement math (common/quota_math.go and related paths) across image, video, audio, and token-count fields, and is fixed in 1.0.0-rc.18. There is no public exploit identified at time of analysis, but the upstream fix commits and GHSA advisory publicly disclose the vulnerable code paths.
Memory corruption in the kernel-mode driver component of BeyondTrust Endpoint Privilege Management for Windows (all versions prior to 26.1.2) allows a low-privileged local user to trigger an out-of-bounds read, potentially disclosing kernel memory contents or corrupting system state. The flaw is rooted in insufficient input validation within a Ring 0 component - the most privileged execution layer on Windows - amplifying the potential impact of what would otherwise be a constrained user-level action. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in version 26.1.2.
Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing.
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.
Arbitrary code execution in SteelSeries GG for macOS v107.0.0 stems from a buffer overflow in the bundled libSSEdevice.dylib, specifically its dup_wcs (wide-character string duplication) routine, letting an attacker who can feed crafted input to the client run code with the privileges of the SteelSeries process. The flaw is disclosed by MITRE with an accompanying Cipher Security Labs research write-up (publicly available research/exploit material), but it is not on the CISA KEV list and EPSS is low at 0.21% (12th percentile). Note a material discrepancy: the CVSS vector is scored AV:N (network) yet the affected component is a local desktop peripheral-management library, which typically implies attacker-supplied data rather than an exposed network service.
Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet.
Memory-corruption remote code execution affects SteelSeries GG for macOS v107.0.0, where a classic buffer overflow (CWE-120) in the bundled libSSEdevice.dylib-specifically the CxAudioHidDevice::DeviceGetDescriptionString routine-lets an attacker overwrite memory while the client parses a device description string and thereby run arbitrary code in the context of the GG process. NVD rates it CVSS 9.8 with an unauthenticated network vector, though the affected component is a HID (USB audio device) descriptor parser, which points toward a malicious-device attack surface rather than pure network reachability. A third-party research writeup (Cipher-Security-Labs CSL-2026-03) is referenced, but there is no CISA KEV listing and EPSS is low at 0.21% (12th percentile).
Remote buffer overflow in Edimax EW-7478APC firmware 1.04 allows network-authenticated attackers to corrupt memory via the selSSID argument in the formWlSiteSurvey handler, with potential for arbitrary code execution on both the vulnerable device and downstream systems. The CVSS 4.0 vector scores this at 8.6 with full high-impact triad across both vulnerable and subsequent systems, reflecting the embedded device context where exploitation typically yields root-level access. A public exploit exists (CVSS 4.0 E:P confirmed), and the vendor has not responded to coordinated disclosure, meaning no patch is available or expected in the near term.
Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch.
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs containing circular references are passed to the template context, because the ObjectRecursionLimit property defaults to 0 (unlimited) rather than a bounded safe value. Any endpoint that maps user-controlled input - such as a JSON request body or ORM entity graph - to a Scriban TemplateContext is susceptible to complete process termination with no authentication required (CVSS 4.0 AV:N/AC:L/PR:N). No public exploit or CISA KEV listing has been identified at time of analysis; however, a proof-of-concept is published in GitHub Security Advisory GHSA-grr9-747v-xvcp.
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker who can supply content to Template.Parse to crash the hosting .NET application via an uncatchable StackOverflowException. The flaw exploits a recursion path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is structurally separate from the ExpressionDepthLimit guard introduced in the prior fix for GHSA-wgh7-7m3c-fx25, meaning teams who applied that earlier patch retain a false sense of protection and remain fully vulnerable. A proof-of-concept is publicly available in the GitHub Security Advisory; no confirmed active exploitation appears in the CISA KEV catalog at time of analysis.
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fatally terminate the hosting .NET process. The internal `WriteValue()` serialization function (ObjectFunctions.cs:494) recurses through object members and arrays without depth limits or circular reference detection - bypassing the `ObjectRecursionLimit`, `EnterRecursive()`, and `EnsureSufficientExecutionStack()` guards used everywhere else in Scriban. Because `StackOverflowException` is unrecoverable in .NET, a single crafted template request causes immediate, irreversible process death. No public exploit or CISA KEV listing identified at time of analysis; vendor-confirmed fix is available in version 7.0.0.
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET application by submitting a crafted template containing deeply nested parentheses, array initializers, object initializers, or unary operators. The `ExpressionDepthLimit` parser guard is structurally non-enforcing: it logs a non-fatal error and sets a flag but never halts recursive descent, allowing the call stack to exhaust until an uncatchable `StackOverflowException` terminates the process - roughly achievable with an 8 KB payload. This is a regression that re-opens two previously reported 'fixed' advisories (GHSA-wgh7-7m3c-fx25, fixed in 6.6.0; GHSA-p6q4-fgr8-vx4p, fixed in 7.0.0), confirming both prior fixes are incomplete; no public exploit or KEV listing exists at time of analysis.
Unbounded recursion in the Linux kernel's slab allocator free path can crash the kernel when memory allocation profiling or cgroup memory accounting is active. Specific size relationships between KMALLOC_NORMAL caches cause circular obj_exts array dependencies - for example, kmalloc-512 and kmalloc-1k each hold the other's obj_exts array - so freeing one slab triggers a chain of recursive kfree/discard_slab calls that exhausts the kernel task stack. This was confirmed to cause production kernel stack overflows at Meta's infrastructure (approximately 125 recursive frames observed) and is fixed in Linux 6.12.103, 6.18.44, and 7.1.8; no public exploit code exists and exploitation probability is very low (EPSS 0.18%).
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Out-of-bounds slab read in the Linux kernel keyring subsystem's `keyring_get_key_chunk()` exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a `kmemdup`-allocated buffer. This is reachable via the standard `add_key(2)` syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.
Heap buffer overflow in the Linux kernel iSCSI TCP initiator (drivers/scsi/libiscsi_tcp.c) lets a malicious or compromised iSCSI target overflow the fixed 8192-byte conn->data buffer by returning a SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) whose DataSegmentLength exceeds ISCSI_DEF_MAX_RECV_SEG_LEN. Unlike LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT, the SCSI response path copied sense/response data into conn->data without bounding it against the buffer size, only against the negotiated MaxRecvDataSegmentLength (open-iscsi default 262144). Any Linux host acting as an iSCSI initiator against an untrusted target is affected; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), and it is not on CISA KEV.
Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The `ath12k_mac_dp_peer_cleanup()` function incorrectly indexes a 256-bit bitmap with `dp_peer->peer_id`, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing `clear_bit()` to write far outside the valid bitmap range. No public exploit has been identified at time of analysis, and EPSS probability stands at 0.14%, though the CVSS 8.8 rating reflects the adjacent-network, unauthenticated vector and full kernel-level C/I/A impact of the memory corruption primitive.
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. No public exploit has been identified at time of analysis, and patched stable releases 7.1.8 and 7.2-rc6 are available.
Out-of-bounds slab read in the Linux kernel's binfmt_misc subsystem allows local low-privileged users - including those operating within unprivileged user namespaces - to trigger heap memory exposure or a kernel crash by registering a binary format with a flag character ('P', 'O', 'C', or 'F') as the field delimiter. The flaw exists because check_special_flags() consumes flag characters without using the delimiter as a terminator, swallowing the 8-byte padding appended by create_entry() and reading past the end of the allocated buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates low near-term exploitation probability; however, reachability from unprivileged user namespaces on most modern Linux distributions meaningfully broadens the real-world attack surface.
Integer overflow in the Linux kernel's scsi_debug module allows a local low-privileged attacker on a 32-bit system to trigger an out-of-bounds write via a crafted SCSI REPORT ZONES command. When alloc_len is in the range 0xFFFFFFC1-0xFFFFFFFF, an ALIGN() rounding operation overflows to 0x100000000, which truncates to zero under 32-bit size_t, causing kzalloc(0) to return a ZERO_SIZE_PTR sentinel that passes null checks - subsequent pointer arithmetic and loop writes then corrupt kernel memory, leading to privilege escalation or kernel panic. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects the narrow exploitation conditions required.
Integer overflow in the Linux kernel SCTP subsystem allows a remote low-privileged attacker to trigger an approximately 8 MiB out-of-bounds write past a socket buffer (skb) tail in kernel heap memory by adding 65,536 unique peer transport addresses to an SCTP association, wrapping the 16-bit transport_count to zero. Affected systems running Linux kernels from the 4.7 era through stable branches prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 are vulnerable. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal current exploitation activity despite the CVSS 8.8 rating.
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. No public exploit has been identified and this is not in CISA KEV; EPSS stands at 0.17% (6th percentile), reflecting very low in-the-wild exploitation probability despite a CVSS 7.8 score.
Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. Exploitation status: no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.
Heap overflow in the Linux kernel ASoC SOF IPC3 control subsystem allows a local low-privileged user to write past the end of a kernel heap allocation and over-read adjacent heap memory via the ALSA TLV kcontrol interface. The root cause is an off-by-offset bounds check in `bytes_ext_put` and `bytes_ext_get` that compared user-supplied lengths against the full allocation size rather than the actual payload capacity at `cdata->data`, enabling up to `sizeof(struct sof_ipc_ctrl_data)` bytes of out-of-bounds write and disclosure. Patched versions are confirmed across multiple stable branches (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or active exploitation has been identified at time of analysis.
Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.
Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.
Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Race condition in the Linux kernel's HugeTLB page table protection code allows a local low-privileged user to corrupt page tracking state or leak memory access metadata. Specifically, make_uffd_wp_huge_pte() in fs/proc/task_mmu.c invokes huge_ptep_modify_prot_commit() on a PTE snapshot captured without the preceding huge_ptep_modify_prot_start() atomic clear, creating a window where hardware can set Dirty or Accessed bits between the read and commit, which are then silently overwritten with stale values. EPSS is 0.21% (11th percentile) and no active exploitation has been confirmed - this is a correctness/integrity fix in the kernel stable queue, not a commonly weaponized class of vulnerability.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
Memory corruption in the Linux kernel's ThunderboltIP receive path allows an adjacent unauthenticated attacker to overflow the skb frags[] array by sending a crafted multi-frame packet with 19 or more small frames. The insufficient frame_count bound in tbnet_check_frame() (capped at TBNET_RING_SIZE/4 = 64) far exceeds MAX_SKB_FRAGS (17), causing skb_add_rx_frag() to write past the frags[] array and corrupt kernel memory. EPSS is low (0.21%, 11th percentile), no public exploit exists, and CISA KEV confirmation is absent, but CVSS 8.8 reflects the severity of kernel memory corruption once Thunderbolt physical access is achieved.
Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.
Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).
Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.
Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.
An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.
Kernel out-of-bounds read in the Linux SCSI target (LIO/TCM) subsystem lets a SCSI initiator crash the host by sending a malformed PERSISTENT RESERVE OUT command. The iSCSI TransportID parser (target_parse_pr_out_transport_id / iscsi_parse_pr_out_transport_id) scans for the ',i,0x' ISID separator with an unbounded strstr(), so a TransportID whose iSCSI name has no separator and no NUL terminator runs the scan off the end of a multi-page vmap buffer into the vmalloc guard page, oopsing the kernel (KASAN: vmalloc-out-of-bounds). It is reachable by any fabric delivering PR OUT to an iSCSI-exported device, including a guest via vhost-scsi. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not in CISA KEV.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Stack-based buffer overflow in UTT HiPER 1200GW firmware through version 2.5.3-170306 enables remote code execution via a crafted timestart parameter submitted to the /goform/formGroupConfig endpoint. The root cause is an unbounded strcpy() call (CWE-121) in the formGroupConfig handler that overwrites stack memory without validating input length. A public proof-of-concept exploit has been published to GitHub, and the CVSS 4.0 score of 8.6 with high impact across both the vulnerable device and subsequent network systems underscores the potential for network-wide compromise through this gateway appliance.
Stack-based buffer overflow in TRENDnet TEW-823DRU firmware 1.1.02b01 allows authenticated remote attackers to overwrite stack memory and achieve arbitrary code execution by supplying an oversized value to the `wan_l2tp_password` parameter processed by `/cgi-bin/wan.cgi`. The vulnerability stems from an unbounded `strcpy()` call in the NVRAM handling component, with no input length validation applied before the copy. A public proof-of-concept exploit script is available on GitHub, substantially lowering the bar for opportunistic exploitation against any reachable management interface.
Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's WebGL implementation (all versions prior to 151.0.7922.169) enables a remote attacker to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The sandbox escape elevates the impact from renderer-level code execution to potential full OS-level compromise. No public exploit code or active exploitation has been identified at the time of analysis, but the SSVC technical impact rating is 'total,' reflecting the severity of successful exploitation.
Stack-based buffer overflow in the alphapd web server daemon of TRENDnet TV-IP751WIC firmware 11.03.03 allows low-privileged remote attackers to execute arbitrary code by sending malformed input to any of seven vulnerable configuration-handling functions. Seven distinct code paths - SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, websCheckRealm, FUN_00432574, and FUN_0043372C - copy user-supplied configuration values onto the stack without enforcing length limits. A public proof-of-concept exploit has been published on GitHub, and the CVSS 4.0 score of 8.6 with E:P reflects meaningfully elevated exploitation risk even absent CISA KEV listing.
Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. A public proof-of-concept exploit exists, no public exploit identified as confirmed active exploitation (no CISA KEV listing), and no vendor patch has been confirmed at time of analysis.
Out-of-bounds read with unbounded memory allocation in the surfio Python/C++ library affects all versions prior to 0.0.19, where the Irap ASCII and binary surface-file parsers trust attacker-controllable ncol/nrow size fields in the header without validating them against the actual input length. A remote attacker who can supply a crafted .irap file to an application that parses it - the vendor explicitly rates severity assuming surfio runs in a networked service - can trigger a memory over-read and force allocation of tens of megabytes from a single tiny value, causing information disclosure or denial of service. No public exploit identified at time of analysis; the issue is fixed in 0.0.19.
Memory-corruption in Equinor's resdata library before 6.2.9 lets a crafted GRDECL reservoir-model file trigger a classic buffer overflow, out-of-bounds read, improper array indexing, and NULL-pointer dereference during parsing. Any application that feeds untrusted GRDECL input to resdata - the maintainer explicitly rates the 9.8 severity for a networked webservice that parses attacker-supplied files - is exposed to memory corruption that can lead to crashes, information disclosure, or potentially code execution. No public exploit identified at time of analysis, and the flaw is not on CISA KEV.
Buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux enables an unauthenticated attacker with Layer 2 network adjacency to achieve code execution by sending specially crafted LLDP frames. Both the GA track (all versions through 5.16) and LTS track (through 5.11.5 and 5.9.5 respectively) are confirmed affected. No active exploitation or public proof-of-concept code has been identified at time of analysis, though CISA SSVC rates the technical impact as total given that a successful exploit yields full switch compromise.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate.
Stack-based buffer overflow in the DHCP blobmsg handler within /sbin/netifd on TRENDnet TEW-WLC100P firmware 12.07b01 allows unauthenticated adjacent-network attackers to execute arbitrary code with no user interaction required. A working proof-of-concept Python exploit script has been publicly released on GitHub, materially lowering the skill threshold for exploitation. No CISA KEV listing exists at time of analysis and no vendor patch has been identified, leaving affected devices exposed with only network-level compensating controls available.
Memory-safety defects in Mozilla Firefox 153 could allow remote attackers to corrupt memory and potentially achieve arbitrary code execution when a victim renders malicious web content, and were resolved in Firefox 154. These bugs were discovered internally by Mozilla with no public exploit identified at time of analysis, and the EPSS exploitation probability is low (0.15%, 5th percentile). The issues are classified as buffer/memory-corruption defects (CWE-119) that Mozilla presumes could have been exploited with sufficient effort.
Memory-corruption defects in Mozilla Firefox 153 and Firefox ESR 153.0, disclosed by Mozilla in advisories MFSA2026-74/77/78/80, could allow a remote attacker to corrupt memory and potentially achieve arbitrary code execution within the browser process. The issues were found internally by Mozilla developers and fixed in Firefox 154 and Firefox ESR 153.1. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with a proactively-patched roll-up of memory-safety bugs rather than an actively exploited flaw.
Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1.
Memory corruption in Mozilla Firefox 153, Firefox ESR 153.0, and Firefox ESR 140.13 allows remote attackers to potentially execute arbitrary code within the browser process when a victim renders attacker-controlled web content. Mozilla internally discovered a batch of memory-safety defects (tracked across advisories MFSA2026-74 through MFSA2026-80) and states that some showed evidence of memory corruption presumed exploitable with sufficient effort. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Remote code execution in Systerel S2OPC 1.7.3 arises from a heap out-of-bounds write in the server-side EventFilter handling path exercised during CreateMonitoredItems processing. A remote attacker who can reach the OPC UA server endpoint and open a session on an events-enabled server can corrupt heap memory to achieve arbitrary code execution with the privileges of the server process. No public exploit identified at time of analysis, and EPSS is low (0.27%, 20th percentile), indicating the CVSS 9.8 rating reflects potential impact rather than observed mass exploitation.
Memory corruption in Apple's web content rendering engine affects iOS, iPadOS, and macOS Tahoe, enabling high-impact device compromise when a user processes maliciously crafted web content. All iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe versions prior to 26.6.2, are confirmed affected per Apple security advisories and EUVD-2026-60510. Apple has released patched builds across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Deskflow clients prior to continuous build 1.26.0.299 allows a network-reachable malicious server to crash the connected client or disclose up to four bytes of client process memory at an attacker-controlled relative offset. The flaw lives in ServerProxy::setOptions(), where crafted kMsgDSetOptions (DSOP) option values corrupt m_modifierTranslationTable indexes that translateKey() and translateModifierMask() then use to index static seven-row lookup arrays beyond their valid bounds. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no client-side user interaction beyond an established server connection.
Out-of-bounds read in Deskflow's client-side `ServerProxy::setOptions()` allows a malicious Deskflow server to crash any connected client by sending an odd-length DSOP options vector during the handshake sequence. Affected releases span from 1.17.0 through all continuous builds before 1.26.0.296, covering the full client codebase across five source files. No active exploitation is listed in CISA KEV and no public exploit code has been identified, though the crash is deterministic and the CVSS C:L component reflects marginal heap/stack memory disclosure from the out-of-bounds read.
Stack-based buffer overflow in Notepad++ before version 8.9.7 enables local code execution or process termination through the Run Dialog's variable expansion routine. The `expandNppEnvironmentStrs` function copies Notepad++ variable names from `$(...)` syntax into a fixed-size `wchar_t str[MAX_PATH]` stack buffer without bounding the loop index `m`, allowing any variable name of 260 or more wide characters to corrupt adjacent stack memory and trigger `__report_gsfailure` or, with precise crafting, execute arbitrary code. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. Proof-of-concept exploit code exists (CVSS 4.0 E:P), elevating real-world risk, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Out-of-bounds heap read in TIER IV Nebula's Vlp32Decoder::unpack() function through version 1.2.0 enables unauthenticated remote attackers to inject fabricated LiDAR point data into autonomous vehicle perception pipelines by sending short malformed UDP datagrams to the Velodyne sensor port. Unlike other Nebula sensor drivers, the VLP-32 UDP listener enforces no sender-address restrictions, making any network-reachable host a valid attacker origin without spoofing. Fabricated points derived from adjacent heap memory contents are silently published into downstream PointCloud2 messages consumed by Autoware nodes, creating a sensor-integrity risk with direct safety implications; no public exploit code and no CISA KEV listing are identified at time of analysis.
Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Out-of-bounds heap read in Belledonne Communications bcg729 through 1.1.2 allows unauthenticated network-adjacent attackers to crash the media process or silently corrupt G.729 comfort-noise generation by delivering a single zero-length SID RTP payload. The root cause is an integer underflow in uint8_t arithmetic inside decodeSIDframe() that causes the function to unconditionally attempt reading 11 bytes from a zero-byte heap buffer, resulting in media process termination or consumption of adjacent heap memory as LP filter reflection coefficients. No public exploit identified at time of analysis, but the trigger condition - one malformed RTP packet - represents a trivially low technical barrier for any attacker already on the RTP session path.
Remote unauthenticated denial-of-service in INDI indiserver through 2.2.4.2 allows any attacker with TCP access to port 7624 to crash the daemon with a single malformed packet. The vulnerability stems from an unbounded sprintf() call writing XML error messages into a fixed 1024-byte stack buffer in MsgQueue.cpp - sending mismatched XML tags whose names exceed that boundary overflows the stack frame and terminates the process, immediately disconnecting all active astronomical instrument drivers and client sessions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack primitive is trivially constructible given the deterministic overflow path confirmed in the patch diff.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Financial fraud via integer overflow in QuantumNous New API (an LLM gateway and AI asset-management platform) lets a low-privileged account with a positive balance or active subscription manipulate user-controlled billing multipliers so that a computed charge wraps into account credit and can drain upstream provider funds. The flaw sits in quota settlement math (common/quota_math.go and related paths) across image, video, audio, and token-count fields, and is fixed in 1.0.0-rc.18. There is no public exploit identified at time of analysis, but the upstream fix commits and GHSA advisory publicly disclose the vulnerable code paths.
Memory corruption in the kernel-mode driver component of BeyondTrust Endpoint Privilege Management for Windows (all versions prior to 26.1.2) allows a low-privileged local user to trigger an out-of-bounds read, potentially disclosing kernel memory contents or corrupting system state. The flaw is rooted in insufficient input validation within a Ring 0 component - the most privileged execution layer on Windows - amplifying the potential impact of what would otherwise be a constrained user-level action. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in version 26.1.2.
Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing.
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.
Arbitrary code execution in SteelSeries GG for macOS v107.0.0 stems from a buffer overflow in the bundled libSSEdevice.dylib, specifically its dup_wcs (wide-character string duplication) routine, letting an attacker who can feed crafted input to the client run code with the privileges of the SteelSeries process. The flaw is disclosed by MITRE with an accompanying Cipher Security Labs research write-up (publicly available research/exploit material), but it is not on the CISA KEV list and EPSS is low at 0.21% (12th percentile). Note a material discrepancy: the CVSS vector is scored AV:N (network) yet the affected component is a local desktop peripheral-management library, which typically implies attacker-supplied data rather than an exposed network service.
Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet.
Memory-corruption remote code execution affects SteelSeries GG for macOS v107.0.0, where a classic buffer overflow (CWE-120) in the bundled libSSEdevice.dylib-specifically the CxAudioHidDevice::DeviceGetDescriptionString routine-lets an attacker overwrite memory while the client parses a device description string and thereby run arbitrary code in the context of the GG process. NVD rates it CVSS 9.8 with an unauthenticated network vector, though the affected component is a HID (USB audio device) descriptor parser, which points toward a malicious-device attack surface rather than pure network reachability. A third-party research writeup (Cipher-Security-Labs CSL-2026-03) is referenced, but there is no CISA KEV listing and EPSS is low at 0.21% (12th percentile).
Remote buffer overflow in Edimax EW-7478APC firmware 1.04 allows network-authenticated attackers to corrupt memory via the selSSID argument in the formWlSiteSurvey handler, with potential for arbitrary code execution on both the vulnerable device and downstream systems. The CVSS 4.0 vector scores this at 8.6 with full high-impact triad across both vulnerable and subsequent systems, reflecting the embedded device context where exploitation typically yields root-level access. A public exploit exists (CVSS 4.0 E:P confirmed), and the vendor has not responded to coordinated disclosure, meaning no patch is available or expected in the near term.
Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch.
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs containing circular references are passed to the template context, because the ObjectRecursionLimit property defaults to 0 (unlimited) rather than a bounded safe value. Any endpoint that maps user-controlled input - such as a JSON request body or ORM entity graph - to a Scriban TemplateContext is susceptible to complete process termination with no authentication required (CVSS 4.0 AV:N/AC:L/PR:N). No public exploit or CISA KEV listing has been identified at time of analysis; however, a proof-of-concept is published in GitHub Security Advisory GHSA-grr9-747v-xvcp.
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker who can supply content to Template.Parse to crash the hosting .NET application via an uncatchable StackOverflowException. The flaw exploits a recursion path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is structurally separate from the ExpressionDepthLimit guard introduced in the prior fix for GHSA-wgh7-7m3c-fx25, meaning teams who applied that earlier patch retain a false sense of protection and remain fully vulnerable. A proof-of-concept is publicly available in the GitHub Security Advisory; no confirmed active exploitation appears in the CISA KEV catalog at time of analysis.
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fatally terminate the hosting .NET process. The internal `WriteValue()` serialization function (ObjectFunctions.cs:494) recurses through object members and arrays without depth limits or circular reference detection - bypassing the `ObjectRecursionLimit`, `EnterRecursive()`, and `EnsureSufficientExecutionStack()` guards used everywhere else in Scriban. Because `StackOverflowException` is unrecoverable in .NET, a single crafted template request causes immediate, irreversible process death. No public exploit or CISA KEV listing identified at time of analysis; vendor-confirmed fix is available in version 7.0.0.
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET application by submitting a crafted template containing deeply nested parentheses, array initializers, object initializers, or unary operators. The `ExpressionDepthLimit` parser guard is structurally non-enforcing: it logs a non-fatal error and sets a flag but never halts recursive descent, allowing the call stack to exhaust until an uncatchable `StackOverflowException` terminates the process - roughly achievable with an 8 KB payload. This is a regression that re-opens two previously reported 'fixed' advisories (GHSA-wgh7-7m3c-fx25, fixed in 6.6.0; GHSA-p6q4-fgr8-vx4p, fixed in 7.0.0), confirming both prior fixes are incomplete; no public exploit or KEV listing exists at time of analysis.
Unbounded recursion in the Linux kernel's slab allocator free path can crash the kernel when memory allocation profiling or cgroup memory accounting is active. Specific size relationships between KMALLOC_NORMAL caches cause circular obj_exts array dependencies - for example, kmalloc-512 and kmalloc-1k each hold the other's obj_exts array - so freeing one slab triggers a chain of recursive kfree/discard_slab calls that exhausts the kernel task stack. This was confirmed to cause production kernel stack overflows at Meta's infrastructure (approximately 125 recursive frames observed) and is fixed in Linux 6.12.103, 6.18.44, and 7.1.8; no public exploit code exists and exploitation probability is very low (EPSS 0.18%).
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Out-of-bounds slab read in the Linux kernel keyring subsystem's `keyring_get_key_chunk()` exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a `kmemdup`-allocated buffer. This is reachable via the standard `add_key(2)` syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.
Heap buffer overflow in the Linux kernel iSCSI TCP initiator (drivers/scsi/libiscsi_tcp.c) lets a malicious or compromised iSCSI target overflow the fixed 8192-byte conn->data buffer by returning a SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) whose DataSegmentLength exceeds ISCSI_DEF_MAX_RECV_SEG_LEN. Unlike LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT, the SCSI response path copied sense/response data into conn->data without bounding it against the buffer size, only against the negotiated MaxRecvDataSegmentLength (open-iscsi default 262144). Any Linux host acting as an iSCSI initiator against an untrusted target is affected; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), and it is not on CISA KEV.
Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The `ath12k_mac_dp_peer_cleanup()` function incorrectly indexes a 256-bit bitmap with `dp_peer->peer_id`, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing `clear_bit()` to write far outside the valid bitmap range. No public exploit has been identified at time of analysis, and EPSS probability stands at 0.14%, though the CVSS 8.8 rating reflects the adjacent-network, unauthenticated vector and full kernel-level C/I/A impact of the memory corruption primitive.
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. No public exploit has been identified at time of analysis, and patched stable releases 7.1.8 and 7.2-rc6 are available.
Out-of-bounds slab read in the Linux kernel's binfmt_misc subsystem allows local low-privileged users - including those operating within unprivileged user namespaces - to trigger heap memory exposure or a kernel crash by registering a binary format with a flag character ('P', 'O', 'C', or 'F') as the field delimiter. The flaw exists because check_special_flags() consumes flag characters without using the delimiter as a terminator, swallowing the 8-byte padding appended by create_entry() and reading past the end of the allocated buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates low near-term exploitation probability; however, reachability from unprivileged user namespaces on most modern Linux distributions meaningfully broadens the real-world attack surface.
Integer overflow in the Linux kernel's scsi_debug module allows a local low-privileged attacker on a 32-bit system to trigger an out-of-bounds write via a crafted SCSI REPORT ZONES command. When alloc_len is in the range 0xFFFFFFC1-0xFFFFFFFF, an ALIGN() rounding operation overflows to 0x100000000, which truncates to zero under 32-bit size_t, causing kzalloc(0) to return a ZERO_SIZE_PTR sentinel that passes null checks - subsequent pointer arithmetic and loop writes then corrupt kernel memory, leading to privilege escalation or kernel panic. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects the narrow exploitation conditions required.
Integer overflow in the Linux kernel SCTP subsystem allows a remote low-privileged attacker to trigger an approximately 8 MiB out-of-bounds write past a socket buffer (skb) tail in kernel heap memory by adding 65,536 unique peer transport addresses to an SCTP association, wrapping the 16-bit transport_count to zero. Affected systems running Linux kernels from the 4.7 era through stable branches prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 are vulnerable. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal current exploitation activity despite the CVSS 8.8 rating.
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. No public exploit has been identified and this is not in CISA KEV; EPSS stands at 0.17% (6th percentile), reflecting very low in-the-wild exploitation probability despite a CVSS 7.8 score.
Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. Exploitation status: no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.
Heap overflow in the Linux kernel ASoC SOF IPC3 control subsystem allows a local low-privileged user to write past the end of a kernel heap allocation and over-read adjacent heap memory via the ALSA TLV kcontrol interface. The root cause is an off-by-offset bounds check in `bytes_ext_put` and `bytes_ext_get` that compared user-supplied lengths against the full allocation size rather than the actual payload capacity at `cdata->data`, enabling up to `sizeof(struct sof_ipc_ctrl_data)` bytes of out-of-bounds write and disclosure. Patched versions are confirmed across multiple stable branches (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or active exploitation has been identified at time of analysis.
Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.
Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.
Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Race condition in the Linux kernel's HugeTLB page table protection code allows a local low-privileged user to corrupt page tracking state or leak memory access metadata. Specifically, make_uffd_wp_huge_pte() in fs/proc/task_mmu.c invokes huge_ptep_modify_prot_commit() on a PTE snapshot captured without the preceding huge_ptep_modify_prot_start() atomic clear, creating a window where hardware can set Dirty or Accessed bits between the read and commit, which are then silently overwritten with stale values. EPSS is 0.21% (11th percentile) and no active exploitation has been confirmed - this is a correctness/integrity fix in the kernel stable queue, not a commonly weaponized class of vulnerability.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
Memory corruption in the Linux kernel's ThunderboltIP receive path allows an adjacent unauthenticated attacker to overflow the skb frags[] array by sending a crafted multi-frame packet with 19 or more small frames. The insufficient frame_count bound in tbnet_check_frame() (capped at TBNET_RING_SIZE/4 = 64) far exceeds MAX_SKB_FRAGS (17), causing skb_add_rx_frag() to write past the frags[] array and corrupt kernel memory. EPSS is low (0.21%, 11th percentile), no public exploit exists, and CISA KEV confirmation is absent, but CVSS 8.8 reflects the severity of kernel memory corruption once Thunderbolt physical access is achieved.
Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.
Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).
Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.
Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.
An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.
Kernel out-of-bounds read in the Linux SCSI target (LIO/TCM) subsystem lets a SCSI initiator crash the host by sending a malformed PERSISTENT RESERVE OUT command. The iSCSI TransportID parser (target_parse_pr_out_transport_id / iscsi_parse_pr_out_transport_id) scans for the ',i,0x' ISID separator with an unbounded strstr(), so a TransportID whose iSCSI name has no separator and no NUL terminator runs the scan off the end of a multi-page vmap buffer into the vmalloc guard page, oopsing the kernel (KASAN: vmalloc-out-of-bounds). It is reachable by any fabric delivering PR OUT to an iSCSI-exported device, including a guest via vhost-scsi. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not in CISA KEV.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.