Buffer Overflow
Monthly
Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.
Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.
Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.
Heap-based out-of-bounds read and write in FreeRDP before 3.30.0 can be triggered by a malicious peer during CredSSP/NLA Kerberos authentication, allowing information disclosure, heap memory corruption, or denial of service. The flaw exists in kerberos_DecryptMessage() where the peer-supplied 16-bit EC field of a GSS Wrap token is used directly in pointer arithmetic without bounds validation, enabling any RDP peer - rogue server or malicious client - to shift decrypt pointers up to 65535 bytes past the end of a ~60-byte token buffer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote memory exhaustion in Undertow's WebSocket subsystem enables denial of service against any deployed application exposing a Jakarta @ServerEndpoint with an @OnMessage handler. An attacker needs only a standard WebSocket handshake - no credentials, no special tooling - to trigger unbounded Out of Memory conditions on the server. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-prerequisite attack vector (CVSS AV:N/AC:L/PR:N/UI:N) makes exploitation trivially automatable against any reachable Undertow instance.
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-controlled data before a destination buffer in S-EL1 memory via RSA NOPAD encrypt and decrypt operations. The flaw exists in both the mbedTLS software cryptographic backend and the NXP SE050 hardware driver: when the caller supplies an input length exceeding the RSA modulus size, an unsigned integer underflow in the size subtraction produces a huge value, causing a subsequent memcpy to write well before the intended destination buffer in the secure-world heap. No public exploit has been identified at time of analysis; the upstream fix is available at commit 7b8b494 in the OP-TEE GitHub repository.
Stack-out-of-bounds read in the Linux kernel's XFRM/IPsec subsystem allows a local user with network policy configuration privileges to read out-of-bounds kernel stack memory and potentially crash the system by crafting an outbound XFRM policy using an optional IPTFS-mode template. The flaw is an incomplete fix: commit 3d776e31c841 blocked optional tunnel and BEET templates in outbound policies to prevent this exact class of bug, but the later-added IPTFS mode was never covered by that restriction. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15%, and a functional reproducer is embedded in the upstream fix commit, lowering the barrier for any local attacker who discovers the configuration.
Slab-out-of-bounds read in the Linux kernel's wifi cfg80211 subsystem exposes systems with WiFi interfaces to kernel crash or minor memory disclosure when parsing crafted 802.11 frames from a rogue access point. The flaw, located in cfg80211_is_element_inherited() within net/wireless/scan.c, is triggered during Multi-Link Element (MLE) per-STA profile parsing when a zero-length WLAN_EID_EXTENSION element is present in a (re)association response or non-transmitted BSS profile - causing the parser to read one byte past the end of the element buffer. No public exploit or KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) reflects low current exploitation probability, though the adjacent-network attack vector and zero-privilege requirement keep real-world risk elevated for WiFi-attached Linux endpoints.
Client-side data-integrity failure and bounded out-of-bounds read in the Linux kernel SMB/CIFS client (smb3_simple_fallocate_range) allows a malicious or compromised SMB server to cause the client to skip zero-filling holes during fallocate, so a range the client reports as successfully allocated is left as an un-zeroed hole and a later write can fail with ENOSPC; a malformed server-supplied range length can additionally trigger an out-of-bounds read of the zero buffer. Affected systems are Linux hosts that mount SMB3 shares and call fallocate on them; the fix is merged upstream and backported to stable trees. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.17% (6th percentile).
Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.
Out-of-bounds kernel memory read in the Linux kernel ath6kl WiFi driver affects systems using Qualcomm Atheros AR6xxx chipsets from kernel 3.2 onward. The firmware-supplied `num_msg` field (a u8 value, range 0-255) governs a loop in `ath6kl_wmi_tx_complete_event_rx()` without any validation against the actual WMI event buffer length, enabling reads of up to 1020 bytes past the buffer boundary. An adjacent-network attacker with no privileges can potentially exploit this to leak sensitive kernel memory contents or trigger a kernel panic - neither CISA KEV listing nor public exploit code has been identified at time of analysis, and EPSS at 0.18% (7th percentile) corroborates low current exploitation activity.
Out-of-bounds kernel memory read in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros AR600x chipsets to kernel memory disclosure and availability impact via a malicious adjacent-network access point. The ath6kl_wmi_connect_event_rx() function fails to validate firmware-supplied beacon_ie_len, assoc_req_len, and assoc_resp_len fields against the actual WMI event buffer size before parsing 802.11 Information Elements, allowing combined lengths of up to 765 bytes to exceed the buffer boundary and corrupt the wmi->is_wmm_enabled state flag. No public exploit has been identified and the vulnerability is not listed in CISA KEV; EPSS at 0.21% (11th percentile) reflects minimal opportunistic exploitation activity consistent with the niche hardware footprint.
Slab-out-of-bounds read and integer underflow in the Linux kernel mwifiex wifi driver's uAP event handler allow a malicious or malfunctioning Marvell WiFi device (USB/SDIO/PCIe) to leak kernel slab memory or trigger a kernel panic on a host running in AP mode. The firmware-supplied event->len field in EVENT_UAP_STA_ASSOC is never validated before being used to compute assoc_req_ies_len, enabling an attacker who controls device firmware to walk cfg80211_find_ie() past the fixed event_body buffer into adjacent slab objects, or to produce a massive size_t that copies stale kernel bytes into NL80211_CMD_NEW_STATION notifications. No active exploitation has been confirmed (not in CISA KEV) and EPSS places exploitation probability at the 6th percentile, though the CVSS 8.8 base score reflects potential for complete confidentiality and availability compromise against affected configurations.
Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.
Kernel panic via integer overflow in the SCTP stream-reset path allows an unauthenticated remote peer to crash Linux systems running SCTP on interfaces with MTU exceeding 65535 bytes. sctp_process_strreset_inreq() fails to validate that the RESET_OUT_REQUEST constructed in response to a peer's RESET_IN_REQUEST would stay within SCTP_MAX_CHUNK_LEN, causing a __u16 overflow in sctp_make_strreset_req() that produces an undersized socket buffer and a fatal kernel BUG. No public exploit has been identified and EPSS is 0.17% (6th percentile), but the impact is total denial of service on affected hosts.
Buffer overflow in the Linux kernel's mlx5 network driver allows a local low-privileged attacker to crash the kernel or read out-of-bounds kernel memory when querying module EEPROM data via ethtool on systems equipped with Mellanox/NVIDIA ConnectX adapters that advertise the mcia_32dwords capability. The root cause is a struct size mismatch: mlx5_ifc_mcia_reg_bits defines only 12 dwords (48 bytes) of MCIA register storage while the hardware can return up to 32 dwords (128 bytes), causing mlx5_query_mcia() to memcpy beyond the allocated buffer. No public exploit has been identified at time of analysis and EPSS remains low at 0.18%, but the kernel BUG triggered by FORTIFY_SOURCE on patched builds confirms the overflow is reliably reproducible.
Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.
Out-of-bounds read in the Linux kernel Cedrus V4L2 stateless H.264 video decoder driver exposes kernel memory and can cause system instability when a local low-privileged user submits crafted H.264 decode requests with invalid DPB reference indices. The flaw exists in `_cedrus_write_ref_list()`, which uses userspace-supplied ref_pic_list0/ref_pic_list1 index values to index into the fixed `decode->dpb[]` array without bounds validation, accepting out-of-range sentinel values that are technically legal in the stateless H.264 API but were never guarded at the driver use site. No public exploit identified at time of analysis; EPSS of 0.20% at the 10th percentile reflects the niche hardware platform and local-only access requirement.
Out-of-bounds memory access in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver enables a local low-privileged attacker to corrupt kernel memory or freeze the system, with CVSS-assessed high impact across confidentiality, integrity, and availability. The flaw stems from missing minimum-value validation on the hardware downscaling factor - the ISI supports up to 16x downscaling, but no floor check is enforced before writing values to hardware registers, resulting in invalid hardware state and a kernel-level process freeze that survives Ctrl+C. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting the hardware-specific nature of the attack surface.
Out-of-bounds kernel heap access in the Linux kernel's ath6kl WiFi driver allows an adjacent unauthenticated attacker to trigger zero-size or integer-overflowed kernel allocations by transmitting a malformed ADDBA (Block Acknowledgment) WiFi management frame with an out-of-range window size. Affected are Linux kernel versions from the introduction of the vulnerable code in commit bdcd81707973, with patches confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5). No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Out-of-bounds read in the Linux kernel wilc1000 WiFi driver exposes devices with Microchip ATWILC1000 chipsets to memory disclosure and potential denial of service when a rogue access point sends a malformed association response shorter than 6 bytes. The driver's wilc_parse_assoc_resp_info() function performs an integer underflow when computing IE length without first validating the frame meets the minimum fixed-header size, causing kmemdup() to attempt copying up to 65534 bytes of out-of-bounds kernel memory. No public exploit code is identified at time of analysis, and EPSS probability sits at 0.21%, though the adjacent-network vector and no-authentication requirement make this exploitable by any attacker within WiFi range acting as a rogue AP.
Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.
Stack out-of-bounds write in the Linux kernel's libceph client (net/ceph/osdmap.c) allows a malicious or compromised Ceph monitor to corrupt kernel stack memory on any client that mounts cephfs or maps RBD storage. The __decode_pg_temp() and __decode_pg_upmap_items() helpers accepted an attacker-controlled OSD-set length without bounding it to CEPH_PG_MAX_SIZE (32), so an oversized pg_temp/pg_upmap entry in an OSDMap is copied into the fixed-size on-stack ceph_osds.osds[32] array, triggering a KASAN-confirmed stack overflow that can panic the kernel and potentially enable privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not on the CISA KEV list.
Out-of-bounds memory read in the Linux kernel's in-kernel Ceph client (libceph) allows a malicious or compromised Ceph monitor/OSD to crash or potentially leak kernel memory from any host mounting CephFS or RBD. The flaw lives in decode_new_up_state_weight() when parsing a CEPH_MSG_OSD_MAP message: an attacker-controlled length field feeds a multiplication used for a bounds check, and the overflow makes the check pass so the decoder reads past the buffer. EPSS is low (0.20%, 10th percentile) with no public exploit identified at time of analysis; the CVSS 9.8 appears inflated for what is fundamentally an OOB read reachable only from the Ceph messaging path.
Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Out-of-bounds kernel heap write in the Linux kernel iomap subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw resides in ifs_set_range_dirty() and ifs_set_range_uptodate(), where an unsigned integer underflow on a zero-length range argument produces a near-SIZE_MAX block count, causing bitmap_set() to write arbitrarily far beyond the ifs->state allocation. The reachable code path through __iomap_write_end() requires no special configuration and affects all iomap-backed filesystems (ext4, XFS, etc.). EPSS is low at 0.18% (7th percentile), no KEV listing, and no public exploit has been identified; however, the C:H/I:H/A:H CVSS impact profile reflects the severity of uncontrolled kernel heap corruption.
Race condition in the Linux kernel's SLIP (Serial Line Internet Protocol) driver allows a local attacker with low privileges to trigger an out-of-bounds write or use-after-free in kernel memory, potentially enabling privilege escalation. The `slip_receive_buf()` callback reads and writes the receive buffer `rbuff` without holding `sl->lock`, while `sl_realloc_bufs()` replaces that buffer under the lock during MTU changes - creating a classic TOCTOU window where an MTU shrink can cause writes beyond the new smaller buffer or into a freed allocation. No confirmed active exploitation exists (not in CISA KEV) and the EPSS score of 0.18% places this in the 7th percentile, though kernel memory corruption of this class carries inherent privilege escalation potential.
Kernel heap out-of-bounds write in the Linux MCTP serial driver (drivers/net/mctp/mctp-serial.c) lets an attacker on the serial/tty channel corrupt memory adjacent to the netdev private area on any host where an mctpserialN interface has been configured. The receive state machine accepts a zero-length frame, sets rxlen=0, and enters STATE_DATA, so the 'rxpos == rxlen' terminator never fires and every subsequent inbound byte becomes a 1-byte attacker-controlled OOB heap write past the fixed 74-byte rxbuf, continuing effectively unbounded until a frame or escape byte resets the parser. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the flaw was reproduced with KASAN/UBSAN and carries high memory-corruption impact.
Integer overflow in the Linux kernel's drm/amdgpu VCE (Video Codec Engine) driver enables local low-privileged users on systems with AMD GPU hardware to corrupt GPU memory. Crafted VCE command streams containing extreme image dimensions such as 65536×65536 pixels trigger a 32-bit arithmetic overflow, collapsing the computed buffer size to zero, which bypasses bounds validation and permits the GPU firmware to perform out-of-bounds memory access with scope-change implications rated CVSS 8.8. No public exploit code has been identified and EPSS stands at 0.18% (7th percentile), indicating low real-world exploitation activity; the high score reflects the full-impact scope change to GPU firmware memory rather than immediate internet-facing risk.
Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Kernel memory corruption via out-of-bounds ACE dedup walk in the Linux kernel's ksmbd SMB server subsystem exposes any network-reachable Linux host running ksmbd to high-impact compromise with only low-privilege SMB authentication. When set_ntacl_dacl() terminates ACE copying early due to a size-accounting overflow, set_posix_acl_entries_dacl() continues iterating using the original inflated nt_num_aces count rather than the count of ACEs actually copied, causing the dedup walk to scan into uninitialized buffer tail memory. No public exploit or CISA KEV entry exists at time of analysis, and EPSS remains low at 0.17%, but the patch is available across multiple stable kernel branches and should be applied promptly on any ksmbd-enabled deployment.
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote attackers to corrupt stack memory via the EncryptionMode parameter in the PPTP VPN configuration endpoint, potentially achieving arbitrary code execution on the device. The root cause is unsafe use of strcpy() without bounds validation in the /goform/pptpSrvGlobalConfig handler. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis. No public exploit identified at time of analysis as KEV, but POC lowers the practical exploitation barrier significantly.
Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow a stack/heap buffer via an overly long netAcc.addlist[].name value sent to the app.cgi interface, achieving arbitrary command execution or a device crash. Reported by VulnCheck with a CVSS 4.0 base of 9.3, the flaw is remotely reachable with no authentication or user interaction; no public exploit code has been identified at time of analysis. A vendor patch is available via D-Link advisory SAP10512.
Out-of-bounds kernel memory reads in the Linux kernel's libceph client (decode_lockers() in net/ceph/cls_lock_client.c) let a malicious or compromised Ceph OSD trigger slab-out-of-bounds reads on any kernel client that issues the lock.get_info RADOS class method, such as during RBD exclusive-lock acquisition. A crafted reply with struct_len=0 causes a bare ceph_decode_32() to read 4 bytes past the validated buffer (feeding a garbage locker count into allocation), and a crafted num_lockers lets a subsequent bare ceph_decode_8() read one byte past the end, giving the OSD direct influence over the returned lock-type discriminator. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile); the issue is a memory-safety information-leak/DoS rather than the remote code execution implied by the CNA's 9.8 rating.
Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.
Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.
Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.
Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.
Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.
Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.
Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.
ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted zip file, resulting in a denial-of-service condition. The flaw stems from an out-of-bounds write (CWE-120) caused by missing boundary validation on zip file content during parsing. No public exploit code or active exploitation has been identified at time of analysis, but the fully remote, zero-authentication CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker able to route malicious files through a ClamAV-enabled scanner can reliably trigger the crash.
Heap buffer overflow in stb_truetype.h (nothings stb, up to version 1.26) allows a local attacker to trigger out-of-bounds heap reads by supplying a crafted TTF font file with an inflated endPtsOfContours value and truncated glyph data. Any application statically embedding this library - including game engines and graphics software - that loads attacker-controlled fonts via stbtt_GetGlyphShape() is exposed to potential heap memory disclosure and application crash. No public exploit code has been identified and EPSS at 0.16% (5th percentile) indicates low current exploitation probability; no CISA KEV listing confirms no confirmed active exploitation at time of analysis.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupware through Rollout 524, where an unauthenticated attacker can crash the server by sending a specially crafted JSON body to a vulnerable API endpoint - a payload as small as 8 characters beginning with a number triggers an out-of-bounds stack write. The reliably reachable impact is a server crash, but the underlying buffer overflow could escalate to full server compromise if a stack canary is disclosed via a separate vulnerability. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the high CVSS 4.0 base score (9.5) reflects the worst-case RCE potential rather than confirmed code execution.
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware through Rollout 524, where the Webbox endpoint "//serverClient_close.html" fails to bounds-check multiple form-data parameters. An attacker submitting over-long parameter values triggers an out-of-bounds write (CWE-787) that crashes the server; if a stack canary can be leaked via a separate flaw, the memory corruption could escalate to full server compromise. No public exploit identified at time of analysis, and this CVE is one of 22 reported in the David platform by researchers at InfoGuard/NCSC.ch.
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available in version 1.5.0.
Out-of-bounds write in Autodesk Revit's PDF parser allows arbitrary code execution in the context of the current user process when a maliciously crafted PDF file is opened. The CVSS vector (AV:L/UI:R) confirms exploitation requires local user interaction - a victim must be socially engineered into opening a weaponized PDF. Impact scope covers full confidentiality, integrity, and availability of the running process (C:H/I:H/A:H), consistent with classic memory-corruption RCE chains. No public exploit identified at time of analysis and no CISA KEV listing, but the vendor-confirmed write primitive and RCE potential make this a credible threat for targeted attacks against AEC professionals.
Integer overflow in the llama.cpp LLaMA-Android JNI wrapper (builds b1886 through b7445) allows heap corruption through a crafted n_seq_max parameter, enabling denial of service or arbitrary code execution within Android applications that load untrusted GGUF model files. The flaw exists in the new_1batch() function, which multiplies sizeof(llama_seq_id) by an attacker-controlled value without bounds checking, causing heap allocation to wrap and undersize the buffer. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV; a patched release (b7446) is confirmed available from the upstream ggml-org repository.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
Out-of-bounds write in the Contiki-NG MQTT client (os/net/app-layer/mqtt/mqtt.c) lets a malicious or compromised MQTT broker overflow a 65-byte topic[] buffer and corrupt the adjacent payload_chunk pointer, producing an arbitrary-pointer-write primitive that can escalate to remote code execution on embedded targets lacking memory protection. The flaw stems from parse_publish_vhdr() setting topic_len_received=1 before enforcing the 64-byte topic length limit, so an over-length topic split across TCP segments bypasses the guard on parser re-entry and reaches a memcpy() that trusts the unvalidated 16-bit topic_len. Because the stack has no TLS, the plaintext channel also exposes devices to network man-in-the-middle injection; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds memory read in Contiki-NG's DNS/mDNS resolver exposes adjacent device memory and can crash the resolver on constrained IoT hardware. The root defect is in `skip_name()` within `os/services/resolv/resolv.c`, which traverses DNS wire-format name labels with no packet-boundary guard; the caller `newdata()` drives iteration using an attacker-controlled `nquestions` field from the DNS header before the transaction ID is validated, enabling an attacker to force the function past the end of `uip_buf`. On mDNS-enabled builds, any local-segment peer can trigger this unauthenticated with a single multicast UDP packet to port 5353 and no outstanding query required; on standard DNS builds, an attacker able to inject a spoofed DNS response during an active query achieves the same effect. No public exploit has been identified at time of analysis.
Out-of-bounds heap read in Contiki-NG's LwM2M TLV parser discloses adjacent heap memory - including cryptographic key material and peer IP addresses - to any unauthenticated network attacker. The flaw in `lwm2m_tlv_read()` (os/services/lwm2m/lwm2m-tlv.c) is triggered by a single crafted CoAP WRITE request whose final TLV supplies exactly one byte, causing the parser to read up to five bytes beyond the buffer boundary. Because LwM2M NoSec mode is the default for constrained IoT devices, no authentication is required, and the upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997 (PR #3165) but a tagged release has not been independently confirmed. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the `dry_allowed_length` parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.
Out-of-bounds write in Skia enables sandbox escape in Google Chrome prior to 151.0.7922.109, allowing a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is explicitly a second-stage chaining vulnerability - it does not independently achieve initial code execution but elevates a renderer-level compromise to full OS-level access. No public exploit code or active exploitation has been identified at time of analysis, though the scope-changing nature of this vulnerability makes it a high-value target for chained browser exploit chains.
Remote code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.109 through an out-of-bounds write flaw in the V8 JavaScript engine, triggerable by a crafted HTML page. An unauthenticated remote attacker needs only to lure a victim to a malicious page, achieving code execution confined to the sandboxed renderer process. No public exploit or active exploitation has been identified at time of analysis; however, the CVSS 8.8 score and SSVC total technical impact classification indicate significant potential consequences if exploitation is developed.
Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/GPU translation layer, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt GPU-process memory and potentially break out of the renderer sandbox. Chromium rates the issue Critical and a vendor patch is available, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. The high CVSS 9.6 reflects the scope-changing sandbox-escape potential rather than confirmed in-the-wild use.
Heap buffer overflow in Google Chrome's Base component (versions prior to 151.0.7922.109) enables potential heap corruption and arbitrary code execution when a user installs a malicious Chrome Extension crafted by an attacker. Exploitation requires social engineering to achieve extension installation, reflected in the AC:H/UI:R CVSS metrics, which meaningfully constrains real-world attack scale compared to the raw 7.5 score. No public exploit identified at time of analysis, and a vendor-released patch is available in 151.0.7922.109.
Out-of-bounds write in the GPU process of Google Chrome on Linux enables sandbox escape when an attacker has already compromised the renderer process. Specifically, an attacker controlling the renderer can deliver a crafted HTML page that triggers CWE-787 memory corruption in the GPU process, which operates with higher OS-level privileges than the sandboxed renderer, allowing full sandbox escape. Versions prior to 151.0.7922.109 on Linux are affected; no public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of no public exploit identified at time of analysis.
Heap buffer overflow in the CrashReporting component of Google Chrome prior to 151.0.7922.109 enables sandbox escape when an attacker has already compromised the renderer process and can deliver a crafted HTML page. The CVSS scope change (S:C) and total technical impact rating confirm full host system compromise is achievable as the second stage of a chained exploit. No public exploit code or active exploitation has been identified at time of analysis, per SSVC exploitation status of 'none' and absence from CISA KEV.
Out-of-bounds read in Autodesk Revit's PDF parsing engine exposes users to crashes, sensitive memory disclosure, and arbitrary code execution within the Revit process when opening a maliciously crafted PDF file. Affected are users of Autodesk Revit across versions covered by advisory ADSK-SA-2026-0011, with the attack requiring only that a target be socially engineered into opening a weaponized PDF - a realistic threat vector for AEC-industry professionals who routinely exchange PDF documents. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the high C/I/A impact profile makes this a meaningful risk for targeted attacks against Revit users.
Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated attackers to crash applications that use the library, resulting in a denial of service. Affected versions span APR-util 1.6.0 through 1.6.3; version 1.6.4 resolves the issue per Apache's advisory on the oss-security mailing list. No public exploit code and no CISA KEV listing have been identified at time of analysis, though SSVC classifies the flaw as automatable with partial technical impact, indicating it could be scripted for broad scanning.
Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3) allows remote unauthenticated attackers to crash affected applications, causing denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms full availability impact with no confidentiality or integrity exposure. No public exploit identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning is feasible once attack primitives are established.
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, which moderates near-term opportunistic exploitation risk despite the high CVSS score of 8.6.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.
Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.
Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.
Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.
Heap-based out-of-bounds read and write in FreeRDP before 3.30.0 can be triggered by a malicious peer during CredSSP/NLA Kerberos authentication, allowing information disclosure, heap memory corruption, or denial of service. The flaw exists in kerberos_DecryptMessage() where the peer-supplied 16-bit EC field of a GSS Wrap token is used directly in pointer arithmetic without bounds validation, enabling any RDP peer - rogue server or malicious client - to shift decrypt pointers up to 65535 bytes past the end of a ~60-byte token buffer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote memory exhaustion in Undertow's WebSocket subsystem enables denial of service against any deployed application exposing a Jakarta @ServerEndpoint with an @OnMessage handler. An attacker needs only a standard WebSocket handshake - no credentials, no special tooling - to trigger unbounded Out of Memory conditions on the server. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-prerequisite attack vector (CVSS AV:N/AC:L/PR:N/UI:N) makes exploitation trivially automatable against any reachable Undertow instance.
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-controlled data before a destination buffer in S-EL1 memory via RSA NOPAD encrypt and decrypt operations. The flaw exists in both the mbedTLS software cryptographic backend and the NXP SE050 hardware driver: when the caller supplies an input length exceeding the RSA modulus size, an unsigned integer underflow in the size subtraction produces a huge value, causing a subsequent memcpy to write well before the intended destination buffer in the secure-world heap. No public exploit has been identified at time of analysis; the upstream fix is available at commit 7b8b494 in the OP-TEE GitHub repository.
Stack-out-of-bounds read in the Linux kernel's XFRM/IPsec subsystem allows a local user with network policy configuration privileges to read out-of-bounds kernel stack memory and potentially crash the system by crafting an outbound XFRM policy using an optional IPTFS-mode template. The flaw is an incomplete fix: commit 3d776e31c841 blocked optional tunnel and BEET templates in outbound policies to prevent this exact class of bug, but the later-added IPTFS mode was never covered by that restriction. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15%, and a functional reproducer is embedded in the upstream fix commit, lowering the barrier for any local attacker who discovers the configuration.
Slab-out-of-bounds read in the Linux kernel's wifi cfg80211 subsystem exposes systems with WiFi interfaces to kernel crash or minor memory disclosure when parsing crafted 802.11 frames from a rogue access point. The flaw, located in cfg80211_is_element_inherited() within net/wireless/scan.c, is triggered during Multi-Link Element (MLE) per-STA profile parsing when a zero-length WLAN_EID_EXTENSION element is present in a (re)association response or non-transmitted BSS profile - causing the parser to read one byte past the end of the element buffer. No public exploit or KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) reflects low current exploitation probability, though the adjacent-network attack vector and zero-privilege requirement keep real-world risk elevated for WiFi-attached Linux endpoints.
Client-side data-integrity failure and bounded out-of-bounds read in the Linux kernel SMB/CIFS client (smb3_simple_fallocate_range) allows a malicious or compromised SMB server to cause the client to skip zero-filling holes during fallocate, so a range the client reports as successfully allocated is left as an un-zeroed hole and a later write can fail with ENOSPC; a malformed server-supplied range length can additionally trigger an out-of-bounds read of the zero buffer. Affected systems are Linux hosts that mount SMB3 shares and call fallocate on them; the fix is merged upstream and backported to stable trees. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.17% (6th percentile).
Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.
Out-of-bounds kernel memory read in the Linux kernel ath6kl WiFi driver affects systems using Qualcomm Atheros AR6xxx chipsets from kernel 3.2 onward. The firmware-supplied `num_msg` field (a u8 value, range 0-255) governs a loop in `ath6kl_wmi_tx_complete_event_rx()` without any validation against the actual WMI event buffer length, enabling reads of up to 1020 bytes past the buffer boundary. An adjacent-network attacker with no privileges can potentially exploit this to leak sensitive kernel memory contents or trigger a kernel panic - neither CISA KEV listing nor public exploit code has been identified at time of analysis, and EPSS at 0.18% (7th percentile) corroborates low current exploitation activity.
Out-of-bounds kernel memory read in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros AR600x chipsets to kernel memory disclosure and availability impact via a malicious adjacent-network access point. The ath6kl_wmi_connect_event_rx() function fails to validate firmware-supplied beacon_ie_len, assoc_req_len, and assoc_resp_len fields against the actual WMI event buffer size before parsing 802.11 Information Elements, allowing combined lengths of up to 765 bytes to exceed the buffer boundary and corrupt the wmi->is_wmm_enabled state flag. No public exploit has been identified and the vulnerability is not listed in CISA KEV; EPSS at 0.21% (11th percentile) reflects minimal opportunistic exploitation activity consistent with the niche hardware footprint.
Slab-out-of-bounds read and integer underflow in the Linux kernel mwifiex wifi driver's uAP event handler allow a malicious or malfunctioning Marvell WiFi device (USB/SDIO/PCIe) to leak kernel slab memory or trigger a kernel panic on a host running in AP mode. The firmware-supplied event->len field in EVENT_UAP_STA_ASSOC is never validated before being used to compute assoc_req_ies_len, enabling an attacker who controls device firmware to walk cfg80211_find_ie() past the fixed event_body buffer into adjacent slab objects, or to produce a massive size_t that copies stale kernel bytes into NL80211_CMD_NEW_STATION notifications. No active exploitation has been confirmed (not in CISA KEV) and EPSS places exploitation probability at the 6th percentile, though the CVSS 8.8 base score reflects potential for complete confidentiality and availability compromise against affected configurations.
Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.
Kernel panic via integer overflow in the SCTP stream-reset path allows an unauthenticated remote peer to crash Linux systems running SCTP on interfaces with MTU exceeding 65535 bytes. sctp_process_strreset_inreq() fails to validate that the RESET_OUT_REQUEST constructed in response to a peer's RESET_IN_REQUEST would stay within SCTP_MAX_CHUNK_LEN, causing a __u16 overflow in sctp_make_strreset_req() that produces an undersized socket buffer and a fatal kernel BUG. No public exploit has been identified and EPSS is 0.17% (6th percentile), but the impact is total denial of service on affected hosts.
Buffer overflow in the Linux kernel's mlx5 network driver allows a local low-privileged attacker to crash the kernel or read out-of-bounds kernel memory when querying module EEPROM data via ethtool on systems equipped with Mellanox/NVIDIA ConnectX adapters that advertise the mcia_32dwords capability. The root cause is a struct size mismatch: mlx5_ifc_mcia_reg_bits defines only 12 dwords (48 bytes) of MCIA register storage while the hardware can return up to 32 dwords (128 bytes), causing mlx5_query_mcia() to memcpy beyond the allocated buffer. No public exploit has been identified at time of analysis and EPSS remains low at 0.18%, but the kernel BUG triggered by FORTIFY_SOURCE on patched builds confirms the overflow is reliably reproducible.
Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.
Out-of-bounds read in the Linux kernel Cedrus V4L2 stateless H.264 video decoder driver exposes kernel memory and can cause system instability when a local low-privileged user submits crafted H.264 decode requests with invalid DPB reference indices. The flaw exists in `_cedrus_write_ref_list()`, which uses userspace-supplied ref_pic_list0/ref_pic_list1 index values to index into the fixed `decode->dpb[]` array without bounds validation, accepting out-of-range sentinel values that are technically legal in the stateless H.264 API but were never guarded at the driver use site. No public exploit identified at time of analysis; EPSS of 0.20% at the 10th percentile reflects the niche hardware platform and local-only access requirement.
Out-of-bounds memory access in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver enables a local low-privileged attacker to corrupt kernel memory or freeze the system, with CVSS-assessed high impact across confidentiality, integrity, and availability. The flaw stems from missing minimum-value validation on the hardware downscaling factor - the ISI supports up to 16x downscaling, but no floor check is enforced before writing values to hardware registers, resulting in invalid hardware state and a kernel-level process freeze that survives Ctrl+C. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting the hardware-specific nature of the attack surface.
Out-of-bounds kernel heap access in the Linux kernel's ath6kl WiFi driver allows an adjacent unauthenticated attacker to trigger zero-size or integer-overflowed kernel allocations by transmitting a malformed ADDBA (Block Acknowledgment) WiFi management frame with an out-of-range window size. Affected are Linux kernel versions from the introduction of the vulnerable code in commit bdcd81707973, with patches confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5). No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Out-of-bounds read in the Linux kernel wilc1000 WiFi driver exposes devices with Microchip ATWILC1000 chipsets to memory disclosure and potential denial of service when a rogue access point sends a malformed association response shorter than 6 bytes. The driver's wilc_parse_assoc_resp_info() function performs an integer underflow when computing IE length without first validating the frame meets the minimum fixed-header size, causing kmemdup() to attempt copying up to 65534 bytes of out-of-bounds kernel memory. No public exploit code is identified at time of analysis, and EPSS probability sits at 0.21%, though the adjacent-network vector and no-authentication requirement make this exploitable by any attacker within WiFi range acting as a rogue AP.
Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.
Stack out-of-bounds write in the Linux kernel's libceph client (net/ceph/osdmap.c) allows a malicious or compromised Ceph monitor to corrupt kernel stack memory on any client that mounts cephfs or maps RBD storage. The __decode_pg_temp() and __decode_pg_upmap_items() helpers accepted an attacker-controlled OSD-set length without bounding it to CEPH_PG_MAX_SIZE (32), so an oversized pg_temp/pg_upmap entry in an OSDMap is copied into the fixed-size on-stack ceph_osds.osds[32] array, triggering a KASAN-confirmed stack overflow that can panic the kernel and potentially enable privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not on the CISA KEV list.
Out-of-bounds memory read in the Linux kernel's in-kernel Ceph client (libceph) allows a malicious or compromised Ceph monitor/OSD to crash or potentially leak kernel memory from any host mounting CephFS or RBD. The flaw lives in decode_new_up_state_weight() when parsing a CEPH_MSG_OSD_MAP message: an attacker-controlled length field feeds a multiplication used for a bounds check, and the overflow makes the check pass so the decoder reads past the buffer. EPSS is low (0.20%, 10th percentile) with no public exploit identified at time of analysis; the CVSS 9.8 appears inflated for what is fundamentally an OOB read reachable only from the Ceph messaging path.
Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Out-of-bounds kernel heap write in the Linux kernel iomap subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw resides in ifs_set_range_dirty() and ifs_set_range_uptodate(), where an unsigned integer underflow on a zero-length range argument produces a near-SIZE_MAX block count, causing bitmap_set() to write arbitrarily far beyond the ifs->state allocation. The reachable code path through __iomap_write_end() requires no special configuration and affects all iomap-backed filesystems (ext4, XFS, etc.). EPSS is low at 0.18% (7th percentile), no KEV listing, and no public exploit has been identified; however, the C:H/I:H/A:H CVSS impact profile reflects the severity of uncontrolled kernel heap corruption.
Race condition in the Linux kernel's SLIP (Serial Line Internet Protocol) driver allows a local attacker with low privileges to trigger an out-of-bounds write or use-after-free in kernel memory, potentially enabling privilege escalation. The `slip_receive_buf()` callback reads and writes the receive buffer `rbuff` without holding `sl->lock`, while `sl_realloc_bufs()` replaces that buffer under the lock during MTU changes - creating a classic TOCTOU window where an MTU shrink can cause writes beyond the new smaller buffer or into a freed allocation. No confirmed active exploitation exists (not in CISA KEV) and the EPSS score of 0.18% places this in the 7th percentile, though kernel memory corruption of this class carries inherent privilege escalation potential.
Kernel heap out-of-bounds write in the Linux MCTP serial driver (drivers/net/mctp/mctp-serial.c) lets an attacker on the serial/tty channel corrupt memory adjacent to the netdev private area on any host where an mctpserialN interface has been configured. The receive state machine accepts a zero-length frame, sets rxlen=0, and enters STATE_DATA, so the 'rxpos == rxlen' terminator never fires and every subsequent inbound byte becomes a 1-byte attacker-controlled OOB heap write past the fixed 74-byte rxbuf, continuing effectively unbounded until a frame or escape byte resets the parser. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the flaw was reproduced with KASAN/UBSAN and carries high memory-corruption impact.
Integer overflow in the Linux kernel's drm/amdgpu VCE (Video Codec Engine) driver enables local low-privileged users on systems with AMD GPU hardware to corrupt GPU memory. Crafted VCE command streams containing extreme image dimensions such as 65536×65536 pixels trigger a 32-bit arithmetic overflow, collapsing the computed buffer size to zero, which bypasses bounds validation and permits the GPU firmware to perform out-of-bounds memory access with scope-change implications rated CVSS 8.8. No public exploit code has been identified and EPSS stands at 0.18% (7th percentile), indicating low real-world exploitation activity; the high score reflects the full-impact scope change to GPU firmware memory rather than immediate internet-facing risk.
Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Kernel memory corruption via out-of-bounds ACE dedup walk in the Linux kernel's ksmbd SMB server subsystem exposes any network-reachable Linux host running ksmbd to high-impact compromise with only low-privilege SMB authentication. When set_ntacl_dacl() terminates ACE copying early due to a size-accounting overflow, set_posix_acl_entries_dacl() continues iterating using the original inflated nt_num_aces count rather than the count of ACEs actually copied, causing the dedup walk to scan into uninitialized buffer tail memory. No public exploit or CISA KEV entry exists at time of analysis, and EPSS remains low at 0.17%, but the patch is available across multiple stable kernel branches and should be applied promptly on any ksmbd-enabled deployment.
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote attackers to corrupt stack memory via the EncryptionMode parameter in the PPTP VPN configuration endpoint, potentially achieving arbitrary code execution on the device. The root cause is unsafe use of strcpy() without bounds validation in the /goform/pptpSrvGlobalConfig handler. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis. No public exploit identified at time of analysis as KEV, but POC lowers the practical exploitation barrier significantly.
Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow a stack/heap buffer via an overly long netAcc.addlist[].name value sent to the app.cgi interface, achieving arbitrary command execution or a device crash. Reported by VulnCheck with a CVSS 4.0 base of 9.3, the flaw is remotely reachable with no authentication or user interaction; no public exploit code has been identified at time of analysis. A vendor patch is available via D-Link advisory SAP10512.
Out-of-bounds kernel memory reads in the Linux kernel's libceph client (decode_lockers() in net/ceph/cls_lock_client.c) let a malicious or compromised Ceph OSD trigger slab-out-of-bounds reads on any kernel client that issues the lock.get_info RADOS class method, such as during RBD exclusive-lock acquisition. A crafted reply with struct_len=0 causes a bare ceph_decode_32() to read 4 bytes past the validated buffer (feeding a garbage locker count into allocation), and a crafted num_lockers lets a subsequent bare ceph_decode_8() read one byte past the end, giving the OSD direct influence over the returned lock-type discriminator. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile); the issue is a memory-safety information-leak/DoS rather than the remote code execution implied by the CNA's 9.8 rating.
Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.
Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.
Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.
Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.
Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.
Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.
Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.
ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted zip file, resulting in a denial-of-service condition. The flaw stems from an out-of-bounds write (CWE-120) caused by missing boundary validation on zip file content during parsing. No public exploit code or active exploitation has been identified at time of analysis, but the fully remote, zero-authentication CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker able to route malicious files through a ClamAV-enabled scanner can reliably trigger the crash.
Heap buffer overflow in stb_truetype.h (nothings stb, up to version 1.26) allows a local attacker to trigger out-of-bounds heap reads by supplying a crafted TTF font file with an inflated endPtsOfContours value and truncated glyph data. Any application statically embedding this library - including game engines and graphics software - that loads attacker-controlled fonts via stbtt_GetGlyphShape() is exposed to potential heap memory disclosure and application crash. No public exploit code has been identified and EPSS at 0.16% (5th percentile) indicates low current exploitation probability; no CISA KEV listing confirms no confirmed active exploitation at time of analysis.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupware through Rollout 524, where an unauthenticated attacker can crash the server by sending a specially crafted JSON body to a vulnerable API endpoint - a payload as small as 8 characters beginning with a number triggers an out-of-bounds stack write. The reliably reachable impact is a server crash, but the underlying buffer overflow could escalate to full server compromise if a stack canary is disclosed via a separate vulnerability. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the high CVSS 4.0 base score (9.5) reflects the worst-case RCE potential rather than confirmed code execution.
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware through Rollout 524, where the Webbox endpoint "//serverClient_close.html" fails to bounds-check multiple form-data parameters. An attacker submitting over-long parameter values triggers an out-of-bounds write (CWE-787) that crashes the server; if a stack canary can be leaked via a separate flaw, the memory corruption could escalate to full server compromise. No public exploit identified at time of analysis, and this CVE is one of 22 reported in the David platform by researchers at InfoGuard/NCSC.ch.
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available in version 1.5.0.
Out-of-bounds write in Autodesk Revit's PDF parser allows arbitrary code execution in the context of the current user process when a maliciously crafted PDF file is opened. The CVSS vector (AV:L/UI:R) confirms exploitation requires local user interaction - a victim must be socially engineered into opening a weaponized PDF. Impact scope covers full confidentiality, integrity, and availability of the running process (C:H/I:H/A:H), consistent with classic memory-corruption RCE chains. No public exploit identified at time of analysis and no CISA KEV listing, but the vendor-confirmed write primitive and RCE potential make this a credible threat for targeted attacks against AEC professionals.
Integer overflow in the llama.cpp LLaMA-Android JNI wrapper (builds b1886 through b7445) allows heap corruption through a crafted n_seq_max parameter, enabling denial of service or arbitrary code execution within Android applications that load untrusted GGUF model files. The flaw exists in the new_1batch() function, which multiplies sizeof(llama_seq_id) by an attacker-controlled value without bounds checking, causing heap allocation to wrap and undersize the buffer. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV; a patched release (b7446) is confirmed available from the upstream ggml-org repository.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
Out-of-bounds write in the Contiki-NG MQTT client (os/net/app-layer/mqtt/mqtt.c) lets a malicious or compromised MQTT broker overflow a 65-byte topic[] buffer and corrupt the adjacent payload_chunk pointer, producing an arbitrary-pointer-write primitive that can escalate to remote code execution on embedded targets lacking memory protection. The flaw stems from parse_publish_vhdr() setting topic_len_received=1 before enforcing the 64-byte topic length limit, so an over-length topic split across TCP segments bypasses the guard on parser re-entry and reaches a memcpy() that trusts the unvalidated 16-bit topic_len. Because the stack has no TLS, the plaintext channel also exposes devices to network man-in-the-middle injection; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds memory read in Contiki-NG's DNS/mDNS resolver exposes adjacent device memory and can crash the resolver on constrained IoT hardware. The root defect is in `skip_name()` within `os/services/resolv/resolv.c`, which traverses DNS wire-format name labels with no packet-boundary guard; the caller `newdata()` drives iteration using an attacker-controlled `nquestions` field from the DNS header before the transaction ID is validated, enabling an attacker to force the function past the end of `uip_buf`. On mDNS-enabled builds, any local-segment peer can trigger this unauthenticated with a single multicast UDP packet to port 5353 and no outstanding query required; on standard DNS builds, an attacker able to inject a spoofed DNS response during an active query achieves the same effect. No public exploit has been identified at time of analysis.
Out-of-bounds heap read in Contiki-NG's LwM2M TLV parser discloses adjacent heap memory - including cryptographic key material and peer IP addresses - to any unauthenticated network attacker. The flaw in `lwm2m_tlv_read()` (os/services/lwm2m/lwm2m-tlv.c) is triggered by a single crafted CoAP WRITE request whose final TLV supplies exactly one byte, causing the parser to read up to five bytes beyond the buffer boundary. Because LwM2M NoSec mode is the default for constrained IoT devices, no authentication is required, and the upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997 (PR #3165) but a tagged release has not been independently confirmed. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the `dry_allowed_length` parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.
Out-of-bounds write in Skia enables sandbox escape in Google Chrome prior to 151.0.7922.109, allowing a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is explicitly a second-stage chaining vulnerability - it does not independently achieve initial code execution but elevates a renderer-level compromise to full OS-level access. No public exploit code or active exploitation has been identified at time of analysis, though the scope-changing nature of this vulnerability makes it a high-value target for chained browser exploit chains.
Remote code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.109 through an out-of-bounds write flaw in the V8 JavaScript engine, triggerable by a crafted HTML page. An unauthenticated remote attacker needs only to lure a victim to a malicious page, achieving code execution confined to the sandboxed renderer process. No public exploit or active exploitation has been identified at time of analysis; however, the CVSS 8.8 score and SSVC total technical impact classification indicate significant potential consequences if exploitation is developed.
Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/GPU translation layer, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt GPU-process memory and potentially break out of the renderer sandbox. Chromium rates the issue Critical and a vendor patch is available, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. The high CVSS 9.6 reflects the scope-changing sandbox-escape potential rather than confirmed in-the-wild use.
Heap buffer overflow in Google Chrome's Base component (versions prior to 151.0.7922.109) enables potential heap corruption and arbitrary code execution when a user installs a malicious Chrome Extension crafted by an attacker. Exploitation requires social engineering to achieve extension installation, reflected in the AC:H/UI:R CVSS metrics, which meaningfully constrains real-world attack scale compared to the raw 7.5 score. No public exploit identified at time of analysis, and a vendor-released patch is available in 151.0.7922.109.
Out-of-bounds write in the GPU process of Google Chrome on Linux enables sandbox escape when an attacker has already compromised the renderer process. Specifically, an attacker controlling the renderer can deliver a crafted HTML page that triggers CWE-787 memory corruption in the GPU process, which operates with higher OS-level privileges than the sandboxed renderer, allowing full sandbox escape. Versions prior to 151.0.7922.109 on Linux are affected; no public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of no public exploit identified at time of analysis.
Heap buffer overflow in the CrashReporting component of Google Chrome prior to 151.0.7922.109 enables sandbox escape when an attacker has already compromised the renderer process and can deliver a crafted HTML page. The CVSS scope change (S:C) and total technical impact rating confirm full host system compromise is achievable as the second stage of a chained exploit. No public exploit code or active exploitation has been identified at time of analysis, per SSVC exploitation status of 'none' and absence from CISA KEV.
Out-of-bounds read in Autodesk Revit's PDF parsing engine exposes users to crashes, sensitive memory disclosure, and arbitrary code execution within the Revit process when opening a maliciously crafted PDF file. Affected are users of Autodesk Revit across versions covered by advisory ADSK-SA-2026-0011, with the attack requiring only that a target be socially engineered into opening a weaponized PDF - a realistic threat vector for AEC-industry professionals who routinely exchange PDF documents. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the high C/I/A impact profile makes this a meaningful risk for targeted attacks against Revit users.
Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated attackers to crash applications that use the library, resulting in a denial of service. Affected versions span APR-util 1.6.0 through 1.6.3; version 1.6.4 resolves the issue per Apache's advisory on the oss-security mailing list. No public exploit code and no CISA KEV listing have been identified at time of analysis, though SSVC classifies the flaw as automatable with partial technical impact, indicating it could be scripted for broad scanning.
Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3) allows remote unauthenticated attackers to crash affected applications, causing denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms full availability impact with no confidentiality or integrity exposure. No public exploit identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning is feasible once attack primitives are established.
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, which moderates near-term opportunistic exploitation risk despite the high CVSS score of 8.6.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.