Buffer Overflow
Monthly
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.
Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. Patch-confirmed fixes are available across multiple stable kernel branches; no public exploit code exists and EPSS sits at 0.17%, but the High C/I/A impact of a kernel heap write warrants prompt patching on affected configurations.
Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.
Heap buffer overflow in the Linux kernel's RDMA/rxe (Soft-RoCE) subsystem exposes local low-privileged users to a TOCTOU race condition in get_srq_wqe(), where a concurrent userspace thread can corrupt the num_sge field in a kernel-userspace shared SRQ buffer between its validation and use, bypassing bounds checks on the memcpy into qp->resp.srq_wqe. Affected kernels span from the rxe SRQ introduction at commit 8700e3e7c485 (circa Linux 4.8) through multiple stable branches, with fixes backported to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS at 0.19% reflects limited real-world exploitation activity despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.
Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.
Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.
Out-of-bounds memory access in the Linux kernel's SoundWire audio subsystem exposes local low-privilege users on affected kernel versions to potential privilege escalation to root. The off-by-one loop error in sdw_add_element_group_count, discovered via Google's syzkaller fuzzer, allows iteration to read beyond valid array bounds when the iterator equals the element count, potentially corrupting adjacent kernel memory. No active exploitation is confirmed (no CISA KEV entry), and an EPSS of 0.21% at the 11th percentile reflects minimal real-world exploitation activity at time of analysis, though the local vector and low privilege requirement mean any authenticated user on a SoundWire-equipped system is theoretically within scope.
Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.
Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.
Slab-out-of-bounds read in the Linux kernel ntfs3 filesystem driver exposes kernel heap memory and can cause a denial of service when a crafted NTFS volume is mounted. The flaw resides in `run_get_highest_vcn()`, which iterates over NTFS mapping-pairs buffers with no length bound, trusting a 0x00 terminator that a crafted $LogFile UpdateMappingPairs record can omit; the bug fires unconditionally during `ntfs_fill_super` on mount of the malicious image. Affected stable series span Linux 6.1.x through 7.0.x; the EPSS score is 0.18% (8th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.
Shift-out-of-bounds in the Linux kernel's XFRM subsystem allows a local low-privileged attacker to corrupt kernel memory by crafting an AF_UNSPEC selector with an oversized prefixlen (e.g., 128) and triggering a match against an IPv4 flow when XFRM_STATE_AF_UNSPEC is set. Affected systems span multiple long-term stable kernel branches from 4.19 through 6.12.x, with patched versions available across all impacted series. No public exploit has been identified and the vulnerability is not in CISA KEV; EPSS at 0.22% confirms minimal observed exploitation activity.
Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.
Invalid pointer dereference in the Linux kernel netfilter NAT subsystem exposes local attackers with CAP_NET_ADMIN to kernel slab-out-of-bounds memory access via nf_nat_register_fn(). When nf_nat_init() fails during module initialization, the nat_net pointer is left in an invalid state; subsequent calls to nf_nat_register_fn() dereference it without validation, producing a KASAN-confirmed out-of-bounds read that can escalate to full kernel memory corruption. No public exploit code exists and EPSS at 0.21% (12th percentile) reflects negligible observed exploitation activity, though the local-privilege attack surface in containerized environments warrants timely patching.
Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.
Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds kernel heap write in the Linux kernel Xen PV Calls (pvcalls) frontend allows a malicious or compromised Xen backend domain to corrupt guest kernel memory by supplying a ring response with req_id set beyond PVCALLS_NR_RSP_PER_RING, potentially enabling privilege escalation or denial of service within the affected guest. A compounding int vs. u32 type confusion means req_id=0xffffffff is cast to -1, bypasses a signed comparison, and indexes bedata->rsp[-1] - making the missing bounds check exploitable via two independent paths. Fixes are confirmed in Linux 7.1.5 and 7.2-rc2; no public exploit exists at time of analysis and EPSS is 0.20% at the 10th percentile.
Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.
Integer wraparound in the Linux kernel HID-BPF subsystem's hid_bpf_get_data() helper allows a local low-privileged user to bypass a buffer range check and obtain an out-of-bounds pointer into kernel memory, potentially enabling privilege escalation or memory corruption. Affected kernels span from Linux 6.3 (commit 658ee5a64fcfbbf) through versions prior to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3, where upstream fix commits have landed. No public exploit has been identified at time of analysis and EPSS remains at 0.21%, but the CVSS 7.8 local-privilege score reflects a high-impact, low-complexity code path once local access is established.
Undefined-behavior shift in the Linux kernel's netfilter xt_u32 match module allows a local attacker with CAP_NET_ADMIN to supply malformed packet-filter rules containing shift counts of 32 or more, triggering out-of-bounds shift operations on 32-bit values in u32_match_it() during live packet evaluation. The vulnerability affects all kernel versions from 2.6.23 (when xt_u32 was introduced) through the stable-branch fix commits, with patched versions confirmed across six stable trees. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at the 13th percentile, reflecting currently limited exploitation probability.
Heap out-of-bounds write in the Linux kernel's act_pedit TC offload path allows a local attacker holding CAP_NET_ADMIN to corrupt kernel slab memory with attacker-controlled content, potentially leading to privilege escalation or denial of service. The flaw affects Linux kernel versions from approximately 4.11 through the stable branches patched in 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. Trend Micro ZDI researchers confirmed exploitability via KASAN trace using a targeted POC; no public exploit has been released and this CVE is not listed in the CISA KEV catalog.
Integer overflow in the Linux kernel SMB client's smb2_ioctl_query_info() function enables a malicious SMB server to bypass bounds checking during PASSTHRU_FSCTL response processing, leading to an out-of-bounds kernel memory read disclosed to userspace. Affected systems are Linux kernels across multiple stable branches where OutputOffset and qi.input_buffer_length are summed without overflow protection, allowing a server-controlled 32-bit wrap to defeat the bounds check and cause copy_to_user() to read beyond the response buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects low current exploitation probability, but the network-reachable attack surface and high confidentiality impact (CVSS 8.1) make patching a near-term priority for any Linux host using SMB client connectivity.
Integer overflow in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control handler allows a local, low-privileged attacker on 32-bit platforms to bypass buffer size validation and trigger out-of-bounds memory access in `snd_sof_update_control`. The flaw exists because `sof_ipc3_control_update()` performs unguarded arithmetic on firmware-supplied `cdata->num_elems`, which wraps on 32-bit integer arithmetic and causes the subsequent header size check to pass with mismatched values. No public exploit code exists and no CISA KEV listing is present; EPSS probability is 0.23% at the 14th percentile, with vendor patches available across multiple stable kernel branches.
Integer overflow in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem on 32-bit platforms allows an out-of-bounds kernel heap write via a crafted incoming packet. On 32-bit builds where size_t is four bytes, passing size >= 0xfffffffd to ALIGN(size, 4) wraps the result to zero, bypassing the packet validation check in qrtr_endpoint_post() and allowing skb_put_data() to write attacker-controlled data far beyond the allocated socket buffer. This is the 32-bit residual of commit ad9d24c9429e2, which fixed only the 64-bit case; 64-bit kernels are structurally unaffected. No public exploit is identified at time of analysis, and EPSS at 0.22% reflects low exploitation probability.
Out-of-bounds read in the Linux kernel ATM networking subsystem (`net/atm`) allows local low-privileged users to disclose kernel memory or crash the system by supplying an out-of-range `traffic_class` value via the `SO_ATMQOS` socket option. The flaw persists because `check_tp()` fails to reject traffic class values above `ATM_ANYCLASS`, leaving the invalid value in `vcc->qos` where it is later used as an unguarded array index in `pvc_info()` when `/proc/net/atm/pvc` is read. EPSS sits at 0.22% (13th percentile) with no CISA KEV listing and no public exploit identified, making real-world exploitation risk considerably lower than the CVSS 7.1 score implies, particularly given that ATM networking is a legacy subsystem absent from most modern deployments.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.
Stack-based buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to achieve arbitrary code execution by sending an oversized Comment argument to the setStaticDhcpConfig function via the CGI web interface. Exploit code has been publicly disclosed (CVSS 4.0 E:P), substantially lowering the exploitation barrier. No CISA KEV listing was identified, but the combination of public PoC, network-accessible attack surface, and high C/I/A impact makes this a credible threat for any deployment where the router management interface is reachable by untrusted users.
Stack-based buffer overflow in the TOTOLINK A800R router (firmware 4.1.2cu.5137_B20200730) enables remote code execution via the IPv6 configuration CGI endpoint. The `setRadvdCfg` function in `ipv6.so` fails to validate the length of the `radvdinterfacename` argument before writing it to a stack buffer, allowing an authenticated attacker to overwrite the return address and redirect execution. A public proof-of-concept has been disclosed, and no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.
Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.
Kernel memory corruption in KUNBUS piControl version 2.6.2 allows a local authenticated attacker with device configuration access to write beyond process-image buffer boundaries, corrupting adjacent kernel memory and causing denial of service. The vulnerability resides in process-image management functionality and is triggered by supplying crafted device configuration data and crafted input through the piControl character device. No public exploit code or active exploitation has been confirmed at time of analysis, though the industrial OT context and kernel-level impact elevate operational priority for RevPi deployments.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). Publicly available exploit code exists, raising active risk for any deployment where the web management interface is reachable and low-privilege credentials are obtainable.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to execute arbitrary code by supplying an oversized qosListConnecttedNum argument to the lstAdd function via the /goform/editQos endpoint. The vulnerability affects the QoS Edit component of this SOHO router and carries high impact across confidentiality, integrity, and availability - consistent with full device takeover. A publicly available proof-of-concept exploit exists on GitHub, meaningfully elevating operational urgency despite the absence of CISA KEV confirmation.
Stack/heap buffer overflow in the Tenda AC12 router (firmware 15.03.06.23_multi_TD01) allows remote low-privileged attackers to potentially execute arbitrary code by sending a crafted HTTP request to the `/goform/SetSysAutoRebbotCfg` endpoint with an oversized `rebootTime` argument. All three impact pillars - confidentiality, integrity, and availability - are rated high for the vulnerable system per the CVSS 4.0 vector. Publicly available exploit code exists per a GitHub PoC disclosure; no confirmed CISA KEV listing was identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 exposes authenticated remote attackers to potential arbitrary code execution by sending an oversized `Comment` argument to the `setMacFilterRules` CGI function. A public proof-of-concept has been disclosed on GitHub (corroborated by the CVSS 4.0 E:P modifier), elevating real-world risk beyond the base score of 7.4. No vendor advisory or patched firmware version has been identified at time of analysis, leaving affected devices without an official remediation path.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.
Buffer overflow in the Tenda G0 router's httpd web management interface allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by submitting oversized input to the setPortMapping function via the /goform/module endpoint. All firmware builds up to version 20260625 are confirmed affected per ENISA EUVD-2026-58585. A public proof-of-concept exploit has been released on GitHub, substantially lowering the skill threshold for exploitation; no CISA KEV listing confirming active mass exploitation was present at time of analysis.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows low-privileged remote attackers to corrupt stack memory by sending a crafted `staticRouteNet` argument to the `/goform/module` endpoint, potentially enabling arbitrary code execution on the device. All firmware versions up to and including build 20260625 are confirmed affected. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk; however, no CISA KEV listing has been identified, indicating active exploitation is not yet confirmed at scale.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows network-adjacent or remote authenticated attackers to corrupt stack memory by supplying an oversized value to the portMirrorMirroredPorts argument of the formSetPortMirror function at the /goform/module endpoint. All G0 firmware builds through 20260625 are confirmed affected per EUVD-2026-58575 and NVD CPE data. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation; no CISA KEV listing has been identified, so active widespread exploitation is not confirmed at time of analysis.
Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function `set_wl_guest_iplist` at the `/goform/WifiGuestSet` endpoint fails to validate the length of the `shareSpeed` argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the `httpd` process - which typically runs as root on embedded router firmware. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the barrier to exploitation; no CISA KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis.
Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated attacker to overflow a fixed-size stack buffer in the `set_device_name` function by sending an excessively long `devName` value to the `/goform/SetOnlineDevName` endpoint of the httpd web management interface. Successful exploitation could yield arbitrary code execution on the device with the privileges of the httpd process. A public proof-of-concept exploit has been published on GitHub, elevating real-world risk despite the absence of a CISA KEV listing.
Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.
Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.
Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.
Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds write in IBM i 7.3 through 7.6 enables a local low-privileged attacker to execute arbitrary code, with scope change (S:C) indicating the exploit crosses a security boundary into a higher-privileged component - achieving full confidentiality, integrity, and availability impact. The CVSS score of 8.8 reflects the severity of privilege escalation potential despite requiring local access. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Heap-based buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 3.1 base score of 8.8 and is network-accessible with low attack complexity, making it a high-priority remediation target for IBM Power Systems environments. No public exploit code or active CISA KEV-listed exploitation has been identified at time of analysis; a vendor patch is available via IBM's support portal.
IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.
Out-of-bounds read in IBM i 7.3 through 7.6 exposes sensitive memory contents to unauthenticated remote attackers over the network, with additional limited availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms exploitation requires no authentication and no user interaction, lowering the barrier for opportunistic targeting. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Remote denial-of-service in IBM i 7.3 through 7.6 allows unauthenticated network attackers to crash a host server by submitting malformed requests that trigger an out-of-bounds write (CWE-787) in the server's client data validation logic. The CVSS vector confirms no credentials or user interaction are required, making the attack straightforward to attempt against any network-reachable IBM i host server. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.
Remote code execution in IBM i 7.3 through 7.6 is achievable by any authenticated network attacker via an out-of-bounds write (buffer overflow) triggered over the network. The vulnerability requires only low-level credentials, making it accessible to any valid user account on an internet- or network-exposed IBM i system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor has confirmed the flaw and released a patch via IBM Support.
Remote code execution in IBM i (formerly OS/400) releases 7.3 through 7.6 stems from a buffer overflow (out-of-bounds write) that a remote, unauthenticated attacker can trigger to run arbitrary code on the host. IBM has published a fix, and while the CVSS base score is 9.8, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.37% (30th percentile). CISA's SSVC framing rates exploitation as none and the vulnerability as not automatable, tempering the raw-score urgency.
Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.
Unauthenticated remote exploitation of a buffer overflow in IBM i 7.3 through 7.6 allows attackers to cause denial of service and modify authentication metadata without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially reachable exploitation over the network against default-accessible services. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in PostGIS before 3.7.0beta2 enables low-privileged database users to disclose server process memory or crash the PostgreSQL backend by passing malformed FlatGeobuf geometry data to the extension's property metadata decoder. The decoder validates that a string length prefix is present but omits a bounds check confirming the string body falls within the supplied buffer before materializing it as a SQL-visible value, creating both a memory disclosure and denial-of-service path. A publicly available exploit demonstrates successful memory disclosure against managed PostgreSQL platforms including NeonDB and Supabase; exploitation is not confirmed in CISA KEV but the public proof-of-concept and multi-tenant exposure substantially elevate real-world risk.
Out-of-bounds write in the PostGIS address_standardizer extension through 3.7.0 allows a low-privileged database user to trigger memory corruption in the PostgreSQL server process by supplying a malicious rules table to the standardize_address() function. Missing bounds validation on the classification Type field in gamma.c permits values outside the valid range to be used as raw array indices into an internal output-link table, writing attacker-influenced data to adjacent memory. Publicly available exploit code demonstrates successful exploitation against managed cloud PostgreSQL environments including NeonDB and Supabase; no CISA KEV listing is present at time of analysis.
Out-of-bounds heap write in rsync 3.0.1 through 3.4.x allows a malicious sender to corrupt adjacent heap memory by crafting an argument list that exactly fills the argv allocation in read_args(), causing the trailing NULL terminator to land one slot beyond the allocation boundary. Any rsync client performing a pull operation against an attacker-controlled or compromised server is exposed; heap corruption at this boundary can produce a crash (high availability impact) or potentially a write-what-where condition depending on heap layout. No public exploit code and no CISA KEV listing have been identified at time of analysis; rsync maintainers designated v3.5.0 a major security release, confirming patch availability.
Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.
Out-of-bounds write in rsync 3.0.0 through 3.4.x enables remote memory corruption when a peer sends file entries with the FLAG_HLINKED flag set against a receiver with hard-link preservation disabled. The missing F_SUM field in the file_struct layout permits writes beyond the allocated structure boundary, corrupting adjacent heap or stack data and likely causing denial-of-service or potentially enabling code execution. Vendor-released patch v3.5.0 is available; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Heap out-of-bounds write in rsync 3.2.5 through 3.4.x allows remote unauthenticated attackers to corrupt heap memory by supplying a crafted files-from entry to any exposed rsync daemon module. Critically, the flaw is exploitable against read-only daemon modules - a configuration commonly treated as a safe exposure boundary - by providing a path containing both an interior and trailing backslash, causing add_implied_include() to under-size its destination buffer and write one attacker-controlled byte past the allocation end. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.8 reflects the unauthenticated network attack vector and high availability impact.
Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.
Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.
Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.
Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.
Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. Patch-confirmed fixes are available across multiple stable kernel branches; no public exploit code exists and EPSS sits at 0.17%, but the High C/I/A impact of a kernel heap write warrants prompt patching on affected configurations.
Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.
Heap buffer overflow in the Linux kernel's RDMA/rxe (Soft-RoCE) subsystem exposes local low-privileged users to a TOCTOU race condition in get_srq_wqe(), where a concurrent userspace thread can corrupt the num_sge field in a kernel-userspace shared SRQ buffer between its validation and use, bypassing bounds checks on the memcpy into qp->resp.srq_wqe. Affected kernels span from the rxe SRQ introduction at commit 8700e3e7c485 (circa Linux 4.8) through multiple stable branches, with fixes backported to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS at 0.19% reflects limited real-world exploitation activity despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.
Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.
Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.
Out-of-bounds memory access in the Linux kernel's SoundWire audio subsystem exposes local low-privilege users on affected kernel versions to potential privilege escalation to root. The off-by-one loop error in sdw_add_element_group_count, discovered via Google's syzkaller fuzzer, allows iteration to read beyond valid array bounds when the iterator equals the element count, potentially corrupting adjacent kernel memory. No active exploitation is confirmed (no CISA KEV entry), and an EPSS of 0.21% at the 11th percentile reflects minimal real-world exploitation activity at time of analysis, though the local vector and low privilege requirement mean any authenticated user on a SoundWire-equipped system is theoretically within scope.
Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.
Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.
Slab-out-of-bounds read in the Linux kernel ntfs3 filesystem driver exposes kernel heap memory and can cause a denial of service when a crafted NTFS volume is mounted. The flaw resides in `run_get_highest_vcn()`, which iterates over NTFS mapping-pairs buffers with no length bound, trusting a 0x00 terminator that a crafted $LogFile UpdateMappingPairs record can omit; the bug fires unconditionally during `ntfs_fill_super` on mount of the malicious image. Affected stable series span Linux 6.1.x through 7.0.x; the EPSS score is 0.18% (8th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.
Shift-out-of-bounds in the Linux kernel's XFRM subsystem allows a local low-privileged attacker to corrupt kernel memory by crafting an AF_UNSPEC selector with an oversized prefixlen (e.g., 128) and triggering a match against an IPv4 flow when XFRM_STATE_AF_UNSPEC is set. Affected systems span multiple long-term stable kernel branches from 4.19 through 6.12.x, with patched versions available across all impacted series. No public exploit has been identified and the vulnerability is not in CISA KEV; EPSS at 0.22% confirms minimal observed exploitation activity.
Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.
Invalid pointer dereference in the Linux kernel netfilter NAT subsystem exposes local attackers with CAP_NET_ADMIN to kernel slab-out-of-bounds memory access via nf_nat_register_fn(). When nf_nat_init() fails during module initialization, the nat_net pointer is left in an invalid state; subsequent calls to nf_nat_register_fn() dereference it without validation, producing a KASAN-confirmed out-of-bounds read that can escalate to full kernel memory corruption. No public exploit code exists and EPSS at 0.21% (12th percentile) reflects negligible observed exploitation activity, though the local-privilege attack surface in containerized environments warrants timely patching.
Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.
Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds kernel heap write in the Linux kernel Xen PV Calls (pvcalls) frontend allows a malicious or compromised Xen backend domain to corrupt guest kernel memory by supplying a ring response with req_id set beyond PVCALLS_NR_RSP_PER_RING, potentially enabling privilege escalation or denial of service within the affected guest. A compounding int vs. u32 type confusion means req_id=0xffffffff is cast to -1, bypasses a signed comparison, and indexes bedata->rsp[-1] - making the missing bounds check exploitable via two independent paths. Fixes are confirmed in Linux 7.1.5 and 7.2-rc2; no public exploit exists at time of analysis and EPSS is 0.20% at the 10th percentile.
Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.
Integer wraparound in the Linux kernel HID-BPF subsystem's hid_bpf_get_data() helper allows a local low-privileged user to bypass a buffer range check and obtain an out-of-bounds pointer into kernel memory, potentially enabling privilege escalation or memory corruption. Affected kernels span from Linux 6.3 (commit 658ee5a64fcfbbf) through versions prior to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3, where upstream fix commits have landed. No public exploit has been identified at time of analysis and EPSS remains at 0.21%, but the CVSS 7.8 local-privilege score reflects a high-impact, low-complexity code path once local access is established.
Undefined-behavior shift in the Linux kernel's netfilter xt_u32 match module allows a local attacker with CAP_NET_ADMIN to supply malformed packet-filter rules containing shift counts of 32 or more, triggering out-of-bounds shift operations on 32-bit values in u32_match_it() during live packet evaluation. The vulnerability affects all kernel versions from 2.6.23 (when xt_u32 was introduced) through the stable-branch fix commits, with patched versions confirmed across six stable trees. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at the 13th percentile, reflecting currently limited exploitation probability.
Heap out-of-bounds write in the Linux kernel's act_pedit TC offload path allows a local attacker holding CAP_NET_ADMIN to corrupt kernel slab memory with attacker-controlled content, potentially leading to privilege escalation or denial of service. The flaw affects Linux kernel versions from approximately 4.11 through the stable branches patched in 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. Trend Micro ZDI researchers confirmed exploitability via KASAN trace using a targeted POC; no public exploit has been released and this CVE is not listed in the CISA KEV catalog.
Integer overflow in the Linux kernel SMB client's smb2_ioctl_query_info() function enables a malicious SMB server to bypass bounds checking during PASSTHRU_FSCTL response processing, leading to an out-of-bounds kernel memory read disclosed to userspace. Affected systems are Linux kernels across multiple stable branches where OutputOffset and qi.input_buffer_length are summed without overflow protection, allowing a server-controlled 32-bit wrap to defeat the bounds check and cause copy_to_user() to read beyond the response buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects low current exploitation probability, but the network-reachable attack surface and high confidentiality impact (CVSS 8.1) make patching a near-term priority for any Linux host using SMB client connectivity.
Integer overflow in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control handler allows a local, low-privileged attacker on 32-bit platforms to bypass buffer size validation and trigger out-of-bounds memory access in `snd_sof_update_control`. The flaw exists because `sof_ipc3_control_update()` performs unguarded arithmetic on firmware-supplied `cdata->num_elems`, which wraps on 32-bit integer arithmetic and causes the subsequent header size check to pass with mismatched values. No public exploit code exists and no CISA KEV listing is present; EPSS probability is 0.23% at the 14th percentile, with vendor patches available across multiple stable kernel branches.
Integer overflow in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem on 32-bit platforms allows an out-of-bounds kernel heap write via a crafted incoming packet. On 32-bit builds where size_t is four bytes, passing size >= 0xfffffffd to ALIGN(size, 4) wraps the result to zero, bypassing the packet validation check in qrtr_endpoint_post() and allowing skb_put_data() to write attacker-controlled data far beyond the allocated socket buffer. This is the 32-bit residual of commit ad9d24c9429e2, which fixed only the 64-bit case; 64-bit kernels are structurally unaffected. No public exploit is identified at time of analysis, and EPSS at 0.22% reflects low exploitation probability.
Out-of-bounds read in the Linux kernel ATM networking subsystem (`net/atm`) allows local low-privileged users to disclose kernel memory or crash the system by supplying an out-of-range `traffic_class` value via the `SO_ATMQOS` socket option. The flaw persists because `check_tp()` fails to reject traffic class values above `ATM_ANYCLASS`, leaving the invalid value in `vcc->qos` where it is later used as an unguarded array index in `pvc_info()` when `/proc/net/atm/pvc` is read. EPSS sits at 0.22% (13th percentile) with no CISA KEV listing and no public exploit identified, making real-world exploitation risk considerably lower than the CVSS 7.1 score implies, particularly given that ATM networking is a legacy subsystem absent from most modern deployments.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.
Stack-based buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to achieve arbitrary code execution by sending an oversized Comment argument to the setStaticDhcpConfig function via the CGI web interface. Exploit code has been publicly disclosed (CVSS 4.0 E:P), substantially lowering the exploitation barrier. No CISA KEV listing was identified, but the combination of public PoC, network-accessible attack surface, and high C/I/A impact makes this a credible threat for any deployment where the router management interface is reachable by untrusted users.
Stack-based buffer overflow in the TOTOLINK A800R router (firmware 4.1.2cu.5137_B20200730) enables remote code execution via the IPv6 configuration CGI endpoint. The `setRadvdCfg` function in `ipv6.so` fails to validate the length of the `radvdinterfacename` argument before writing it to a stack buffer, allowing an authenticated attacker to overwrite the return address and redirect execution. A public proof-of-concept has been disclosed, and no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.
Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.
Kernel memory corruption in KUNBUS piControl version 2.6.2 allows a local authenticated attacker with device configuration access to write beyond process-image buffer boundaries, corrupting adjacent kernel memory and causing denial of service. The vulnerability resides in process-image management functionality and is triggered by supplying crafted device configuration data and crafted input through the piControl character device. No public exploit code or active exploitation has been confirmed at time of analysis, though the industrial OT context and kernel-level impact elevate operational priority for RevPi deployments.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). Publicly available exploit code exists, raising active risk for any deployment where the web management interface is reachable and low-privilege credentials are obtainable.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to execute arbitrary code by supplying an oversized qosListConnecttedNum argument to the lstAdd function via the /goform/editQos endpoint. The vulnerability affects the QoS Edit component of this SOHO router and carries high impact across confidentiality, integrity, and availability - consistent with full device takeover. A publicly available proof-of-concept exploit exists on GitHub, meaningfully elevating operational urgency despite the absence of CISA KEV confirmation.
Stack/heap buffer overflow in the Tenda AC12 router (firmware 15.03.06.23_multi_TD01) allows remote low-privileged attackers to potentially execute arbitrary code by sending a crafted HTTP request to the `/goform/SetSysAutoRebbotCfg` endpoint with an oversized `rebootTime` argument. All three impact pillars - confidentiality, integrity, and availability - are rated high for the vulnerable system per the CVSS 4.0 vector. Publicly available exploit code exists per a GitHub PoC disclosure; no confirmed CISA KEV listing was identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 exposes authenticated remote attackers to potential arbitrary code execution by sending an oversized `Comment` argument to the `setMacFilterRules` CGI function. A public proof-of-concept has been disclosed on GitHub (corroborated by the CVSS 4.0 E:P modifier), elevating real-world risk beyond the base score of 7.4. No vendor advisory or patched firmware version has been identified at time of analysis, leaving affected devices without an official remediation path.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.
Buffer overflow in the Tenda G0 router's httpd web management interface allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by submitting oversized input to the setPortMapping function via the /goform/module endpoint. All firmware builds up to version 20260625 are confirmed affected per ENISA EUVD-2026-58585. A public proof-of-concept exploit has been released on GitHub, substantially lowering the skill threshold for exploitation; no CISA KEV listing confirming active mass exploitation was present at time of analysis.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows low-privileged remote attackers to corrupt stack memory by sending a crafted `staticRouteNet` argument to the `/goform/module` endpoint, potentially enabling arbitrary code execution on the device. All firmware versions up to and including build 20260625 are confirmed affected. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk; however, no CISA KEV listing has been identified, indicating active exploitation is not yet confirmed at scale.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows network-adjacent or remote authenticated attackers to corrupt stack memory by supplying an oversized value to the portMirrorMirroredPorts argument of the formSetPortMirror function at the /goform/module endpoint. All G0 firmware builds through 20260625 are confirmed affected per EUVD-2026-58575 and NVD CPE data. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation; no CISA KEV listing has been identified, so active widespread exploitation is not confirmed at time of analysis.
Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function `set_wl_guest_iplist` at the `/goform/WifiGuestSet` endpoint fails to validate the length of the `shareSpeed` argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the `httpd` process - which typically runs as root on embedded router firmware. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the barrier to exploitation; no CISA KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis.
Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated attacker to overflow a fixed-size stack buffer in the `set_device_name` function by sending an excessively long `devName` value to the `/goform/SetOnlineDevName` endpoint of the httpd web management interface. Successful exploitation could yield arbitrary code execution on the device with the privileges of the httpd process. A public proof-of-concept exploit has been published on GitHub, elevating real-world risk despite the absence of a CISA KEV listing.
Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.
Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.
Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.
Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds write in IBM i 7.3 through 7.6 enables a local low-privileged attacker to execute arbitrary code, with scope change (S:C) indicating the exploit crosses a security boundary into a higher-privileged component - achieving full confidentiality, integrity, and availability impact. The CVSS score of 8.8 reflects the severity of privilege escalation potential despite requiring local access. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Heap-based buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 3.1 base score of 8.8 and is network-accessible with low attack complexity, making it a high-priority remediation target for IBM Power Systems environments. No public exploit code or active CISA KEV-listed exploitation has been identified at time of analysis; a vendor patch is available via IBM's support portal.
IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.
Out-of-bounds read in IBM i 7.3 through 7.6 exposes sensitive memory contents to unauthenticated remote attackers over the network, with additional limited availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms exploitation requires no authentication and no user interaction, lowering the barrier for opportunistic targeting. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Remote denial-of-service in IBM i 7.3 through 7.6 allows unauthenticated network attackers to crash a host server by submitting malformed requests that trigger an out-of-bounds write (CWE-787) in the server's client data validation logic. The CVSS vector confirms no credentials or user interaction are required, making the attack straightforward to attempt against any network-reachable IBM i host server. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.
Remote code execution in IBM i 7.3 through 7.6 is achievable by any authenticated network attacker via an out-of-bounds write (buffer overflow) triggered over the network. The vulnerability requires only low-level credentials, making it accessible to any valid user account on an internet- or network-exposed IBM i system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor has confirmed the flaw and released a patch via IBM Support.
Remote code execution in IBM i (formerly OS/400) releases 7.3 through 7.6 stems from a buffer overflow (out-of-bounds write) that a remote, unauthenticated attacker can trigger to run arbitrary code on the host. IBM has published a fix, and while the CVSS base score is 9.8, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.37% (30th percentile). CISA's SSVC framing rates exploitation as none and the vulnerability as not automatable, tempering the raw-score urgency.
Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.
Unauthenticated remote exploitation of a buffer overflow in IBM i 7.3 through 7.6 allows attackers to cause denial of service and modify authentication metadata without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially reachable exploitation over the network against default-accessible services. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in PostGIS before 3.7.0beta2 enables low-privileged database users to disclose server process memory or crash the PostgreSQL backend by passing malformed FlatGeobuf geometry data to the extension's property metadata decoder. The decoder validates that a string length prefix is present but omits a bounds check confirming the string body falls within the supplied buffer before materializing it as a SQL-visible value, creating both a memory disclosure and denial-of-service path. A publicly available exploit demonstrates successful memory disclosure against managed PostgreSQL platforms including NeonDB and Supabase; exploitation is not confirmed in CISA KEV but the public proof-of-concept and multi-tenant exposure substantially elevate real-world risk.
Out-of-bounds write in the PostGIS address_standardizer extension through 3.7.0 allows a low-privileged database user to trigger memory corruption in the PostgreSQL server process by supplying a malicious rules table to the standardize_address() function. Missing bounds validation on the classification Type field in gamma.c permits values outside the valid range to be used as raw array indices into an internal output-link table, writing attacker-influenced data to adjacent memory. Publicly available exploit code demonstrates successful exploitation against managed cloud PostgreSQL environments including NeonDB and Supabase; no CISA KEV listing is present at time of analysis.
Out-of-bounds heap write in rsync 3.0.1 through 3.4.x allows a malicious sender to corrupt adjacent heap memory by crafting an argument list that exactly fills the argv allocation in read_args(), causing the trailing NULL terminator to land one slot beyond the allocation boundary. Any rsync client performing a pull operation against an attacker-controlled or compromised server is exposed; heap corruption at this boundary can produce a crash (high availability impact) or potentially a write-what-where condition depending on heap layout. No public exploit code and no CISA KEV listing have been identified at time of analysis; rsync maintainers designated v3.5.0 a major security release, confirming patch availability.
Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.
Out-of-bounds write in rsync 3.0.0 through 3.4.x enables remote memory corruption when a peer sends file entries with the FLAG_HLINKED flag set against a receiver with hard-link preservation disabled. The missing F_SUM field in the file_struct layout permits writes beyond the allocated structure boundary, corrupting adjacent heap or stack data and likely causing denial-of-service or potentially enabling code execution. Vendor-released patch v3.5.0 is available; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Heap out-of-bounds write in rsync 3.2.5 through 3.4.x allows remote unauthenticated attackers to corrupt heap memory by supplying a crafted files-from entry to any exposed rsync daemon module. Critically, the flaw is exploitable against read-only daemon modules - a configuration commonly treated as a safe exposure boundary - by providing a path containing both an interior and trailing backslash, causing add_implied_include() to under-size its destination buffer and write one attacker-controlled byte past the allocation end. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.8 reflects the unauthenticated network attack vector and high availability impact.
Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.
Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.
Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.
Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.