Buffer Overflow
Monthly
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.
Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. Reported by VMware/Broadcom with no public exploit identified at time of analysis and no CISA KEV listing.
Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact.
Out-of-bounds write in PHP's BCMath bccomp() function allows attacker-controlled inputs to corrupt stack and heap memory in PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9, with high confidentiality, integrity, and availability impact per the vendor CVSS 4.0 score of 8.1. Exploitation requires an application to pass attacker-influenced values into bccomp() with the BCMath extension enabled; there is no public exploit identified at time of analysis (CVSS E:U, no KEV listing). Memory corruption of this class can lead to crashes and, potentially, arbitrary code execution within the PHP process.
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory read in the Dawn (WebGPU) component of Google Chrome before 151.0.7922.72 lets a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Google's Chrome team reported it and a fixed Stable-channel build is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile). Notably, Chromium internally rated the security severity 'Low' even though the NVD-style CVSS base score is 8.1, so real-world impact is likely narrower than the raw score implies.
Out-of-bounds memory access in Google Chrome's Frame component affects all Desktop builds prior to 151.0.7922.72, letting a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Chromium rated the underlying flaw Low severity, yet NVD scores it 8.8 (High) and tags flag potential RCE; there is no public exploit identified at time of analysis and EPSS is a low 0.18% (8th percentile). A vendor patch is available and the issue is not listed in CISA KEV.
Out-of-bounds memory read in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) lets a remote attacker disclose heap memory when a victim opens a crafted HTML page. The flaw is a CWE-122 heap buffer overflow that Chromium itself rated Low severity, with no public exploit identified at time of analysis and an EPSS probability of 0.19% (9th percentile). CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, though technical impact is rated total.
Remote code execution in Google Chrome desktop before 151.0.7922.72 arises from a heap buffer overflow in the browser's media Codecs component (CWE-122), letting a remote attacker who serves a crafted HTML page corrupt heap memory and run arbitrary code - though execution is confined inside the renderer sandbox rather than the host OS. Google rates the Chromium severity as Low despite the NVD-style 8.8 CVSS, and there is no public exploit identified at time of analysis; EPSS is low at 0.24% (15th percentile) and CISA SSVC lists exploitation as none. A vendor patch is available in the 151.0.7922.72 stable channel release.
Out-of-bounds memory read in Chrome's WebXR component allows remote attackers to disclose sensitive renderer process memory or crash the browser tab by luring a victim to a crafted HTML page. All Google Chrome releases prior to 151.0.7922.72 are affected across all platforms, with the vendor confirming a patch in the stable channel update. No public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates low near-term exploitation probability despite the high CVSS base score of 8.1.
Sandbox escape in Google Chrome's media codec handling affects all Chrome desktop builds prior to 151.0.7922.72, where an integer overflow while parsing a maliciously crafted video file can let a remote attacker break out of the renderer sandbox. Exploitation requires the victim to load attacker-controlled media (UI:R), and there is no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the flaw is not on CISA KEV. Notably, Chromium's own triage rated this 'Medium' severity, which conflicts with the NVD-style 9.6 Critical score.
Sandbox escape in Google Chrome's ANGLE graphics layer allows a remote attacker to corrupt memory via a crafted HTML page in versions prior to 151.0.7922.72. The flaw is an out-of-bounds read and write (CWE-125) that a victim triggers simply by visiting a malicious page, potentially letting attacker-controlled code break out of the renderer sandbox. Google has released a fixed stable channel build; there is no public exploit identified at time of analysis and EPSS risk is currently low (0.21%).
Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.
Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.
Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.
Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. Because it requires a pre-compromised renderer, it is typically one link in an exploit chain rather than a single-shot RCE.
Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.
Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.
Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets once an AES-GCM cipher is negotiated during the SSH/SFTP handshake. An unvalidated length field is passed directly to the GCM decrypt routine, overwriting the stack cookie and saved return address before any authentication occurs, potentially yielding code execution as the FTP service. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the pre-auth, network-reachable nature makes it a high priority.
Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write past a heap buffer by sending a malformed SSH client identification string over any SSH or SFTP connection. The flaw is a logic error in the recv-loop termination condition (an OR used where AN AND is required), triggering before authentication and creating strong potential for remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView 2027.0.0 exposes users to application crashes and sensitive memory disclosure when parsing maliciously crafted DWG or DXF files. Exploitation requires a local user to open a weaponized file, making social engineering the primary delivery mechanism targeting CAD operators in AEC and manufacturing environments. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at a negligible 0.12% (2nd percentile), and a vendor patch is available via ADSK-SA-2026-0009.
Arbitrary code execution in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView occurs when a user opens a maliciously crafted DXF file, triggering a heap-based buffer overflow (CWE-122) in the file parser. A local attacker who convinces a victim to open the file can crash the application, read sensitive in-process memory, or run code in the context of the current user. There is no public exploit identified at time of analysis, and the file-format vector plus required user interaction places this in the classic 'malicious drawing file' threat model rather than remote mass exploitation.
Out-of-bounds write in Schneider Electric IGSS (Interactive Graphical SCADA System) Definition module allows an attacker to corrupt memory - causing data loss or potential arbitrary code execution - when a victim imports a maliciously crafted CGF (configuration/definition) file. Exploitation is local and hinges on user interaction (opening/importing the file), with no authentication required once the operator is tricked. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Schneider Electric PSIRT) rates the flaw high at CVSS 8.4.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).
Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.
Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).
Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Opening a malicious file in Adobe Format Plugins can trigger a heap-based buffer overflow, allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported at this time.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote code execution, information disclosure, denial of service, or privilege escalation when processing a malicious WAV file. The flaw resides in the read_WAV_Header() function due to lack of bounds checking on chunk size and bytes-to-skip values, enabling heap corruption. A public proof-of-concept exists (CISA SSVC 'poc'), but no active exploitation has been confirmed in CISA KEV.
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.
Remote heap buffer overflow in the ESP32-audioI2S library 3.4.5 allows unauthenticated attackers to corrupt heap memory, potentially leading to arbitrary code execution or denial of service on affected ESP32 devices. The flaw arises from an unsafe memcpy in AudioBuffer::writeSpace() that copies a full UINT16_MAX bytes without validating the destination buffer size. A public proof-of-concept exists, elevating the urgency for IoT devices using this library.
Denial of service in Schreibfaul1 ESP32-audioI2S version 3.4.5 allows unauthenticated network attackers to crash the audio service by exploiting a buffer overflow in the MP3Decoder::decode() function. Missing validation on untrusted mainDataBegin and nSlots values from incoming MP3 streams leads to memory corruption and service unavailability. No active exploitation or public exploit code has been identified at time of analysis.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to fully compromise a device by sending a malicious MP3 file or stream. The flaw lies in the MP3Decoder::UnpackSFMPEG1 function, which lacks input validation on attacker-controlled MP3 metadata, triggering a classic buffer overflow (CWE-120). A publicly available proof-of-concept exists, although no active exploitation has been confirmed via CISA KEV.
Heap-based buffer overflow in schreibfaul1 ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to corrupt PSRAM memory, leading to denial of service and potential arbitrary code execution. An unchecked unsigned integer overflow when allocating a buffer for audio processing results in an undersized allocation; subsequent read/write operations overrun the heap. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
We are tasked with producing a comprehensive JSON analysis for CVE-2026-51273. We have multiple intelligence sources: mitre (CVE description, CVSS, CWE, references), tags, SSVC, ENISA EUVD. The input provides the CVE ID, description, CVSS score, vector, CWE, and multi-source intel including CPE, references, tags, SSVC, and EUVD data. We must synthesize all this into a JSON object with the specified fields, each a plain text string. First, let's parse all the given data: - CVE ID: CVE-2026-51273 - Description: "In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file." - CVSS Score: 7.8 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-122 (Heap-based Buffer Overflow) - Reported by mitre. - CPE (affected products): cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (this is a placeholder; the real product is schreibfaul1 ESP32-audioI2S, but CPE string is given as "n/a:n/a"). So product is "ESP32-audioI2S" by schreibfaul1. But the CPE doesn't provide a proper string; we'll note that in confidence_notes. - Tags: RCE, Buffer Overflow, N A, Heap Overflow - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. So a proof-of-concept exists, but exploitation is not automatable. - ENISA EUVD: EUVD-2026-49928, affected versions: ["n/a n/a"] (again placeholder). So no specific version range from EUVD, but description says version 3.4.5 is affected. - References: 1. (None) https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp (source code link) 2. (None) https://github.com
Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.
Heap-based buffer overflow in the connecttospeech() function of schreibfaul1 ESP32-audioI2S version 3.4.5 allows remote attackers to achieve arbitrary code execution by supplying an overly long speech text string. The flaw arises because the library performs URL encoding of attacker-controlled input and appends it to a fixed-size heap buffer without length validation, leading to a heap overflow. A public proof-of-concept exploit is available, but active exploitation has not been confirmed.
Heap buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls the audio stream host or URL corrupt memory on the ESP32 microcontroller. The dismantle_host() parser feeds attacker-supplied host, request-host, extension, and query-string segments into clone_from(), which copies them into fixed-size heap buffers without length checks, enabling potential remote code execution or device crash. Rated CVSS 9.8 with SSVC marking technical impact as total and exploitation as automatable, though EPSS is only 0.18% and there is no public exploit identified at time of analysis.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to overflow a heap buffer via crafted HTTP request headers. Public exploit code is available, enabling arbitrary code execution on vulnerable ESP32 devices. No official patch has been released.
Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote attackers to execute arbitrary code, disclose information, crash the service, or escalate privileges by sending a malicious URL with an oversized path and query string to the vulnerable urlencode function. No active exploitation has been confirmed by CISA KEV, and no EPSS score is available at this time.
A heap-based buffer overflow in ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to crash or potentially execute arbitrary code on vulnerable ESP32 devices. The flaw exists in the Audio::openai_speech function, which manually constructs JSON/HTTP payloads by concatenating user input without length checks. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in ESP32-audioI2S 3.4.5’s ID3v2 APIC frame parser lets remote attackers execute arbitrary code or crash vulnerable devices by supplying a crafted MP3 file. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in ESP32-audioI2S 3.4.5 allows remote attackers to cause denial of service, information disclosure, or arbitrary code execution via a crafted MP3 file. Public exploit code is available but no active exploitation is confirmed.
Out-of-bounds read in macOS allows a malicious app to trigger unexpected system termination. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates low probability of widespread exploitation.
Connecting to a malicious SMB server can cause unexpected system termination in macOS due to a memory handling vulnerability (CWE-119). The issue affects all macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 and has been addressed with improved memory handling. No known active exploitation or public exploit code exists, and the EPSS probability of exploitation is very low (0.15%).
Buffer overflow in Apple macOS allows a malicious app to cause unexpected system termination. Affects macOS versions prior to 26.6 (Tahoe). No active exploitation or public exploit code is known, and EPSS indicates a low 0.15% probability of exploitation.
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
Unexpected system termination in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 allows a local application to trigger a denial-of-service via an out-of-bounds read. No active exploitation or public exploit is known, and EPSS indicates a low exploitation probability. The high CVSS score likely overstates the risk, as only a crash is confirmed in the description.
Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
Memory corruption in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local app to cause unexpected system termination or corrupt kernel memory. Despite a CVSS score of 9.8, the attack vector is local and no public exploit or active exploitation has been identified; EPSS estimates exploitation probability at 0.16%, and CISA SSVC confirms no current exploitation but notes the issue is automatable with total technical impact.
Memory corruption in macOS may allow a malicious app to corrupt the memory of a system process, potentially leading to arbitrary code execution. This issue is fixed in macOS Sonoma 14.8.8 and macOS Tah
Denial-of-service
Out-of-bounds read in macOS allows an attacker to crash applications and potentially access sensitive memory by tricking a user into opening a maliciously crafted file. Affecting macOS Son
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Kernel memory corruption in macOS allows remote code execution with high impact on confidentiality, integrity, and availability. A buffer overflow vulnerability allows network-based attackers to execute arbitrary code with kernel privileges, potentially compromising the system. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and while no active exploitation has been reported, the remotely exploitable nature without authentication makes patching critical.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.
Local kernel memory read in macOS via a buffer overflow, fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. A local user with low privileges can trigger the overflow to read sensitive kernel data, potentially leaking encryption keys or credentials. No active exploitation or public exploit code is known.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Kernel memory corruption in Apple macOS allows a remote, unauthenticated attacker to crash the system or corrupt kernel memory on hosts running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Apple's advisory attributes the flaw to insufficient bounds checking (CWE-120), and although the vendor rates it 9.8 with full confidentiality, integrity, and availability impact, our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - the demonstrated outcome is denial of service through kernel termination or memory corruption, with code execution not proven and the triggering service, protocol, or listener undisclosed. No public exploit has been identified at time of analysis, EPSS is low (0.26%, 18th percentile), and CISA's SSVC records exploitation as 'none'; vendor-released patches are available, so remediation should be prioritized on network-exposed macOS hosts rather than treated as an emergency active-exploitation event.
An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.
Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.
Buffer overflow in macOS versions prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to escape its
Kernel memory corruption vulnerability in Apple macOS allows a remote unauthenticated attacker to cause unexpected system termination or potentially execute arbitrary code with kernel privileges. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Although EPSS indicates low exploitation likelihood and no active exploitation or public exploit is reported, the critical CVSS score and network attack vector make patching a priority.
Local kernel memory disclosure and denial-of-service vulnerability in macOS 14.x and 15.x prior to patches. An unauthenticated attacker with local access can trigger a memory handling flaw to read kernel memory or cause unexpected system termination. No active exploitation or public exploit code is known; EPSS score is very low (0.14%).
We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.
Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. Reported by VMware/Broadcom with no public exploit identified at time of analysis and no CISA KEV listing.
Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact.
Out-of-bounds write in PHP's BCMath bccomp() function allows attacker-controlled inputs to corrupt stack and heap memory in PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9, with high confidentiality, integrity, and availability impact per the vendor CVSS 4.0 score of 8.1. Exploitation requires an application to pass attacker-influenced values into bccomp() with the BCMath extension enabled; there is no public exploit identified at time of analysis (CVSS E:U, no KEV listing). Memory corruption of this class can lead to crashes and, potentially, arbitrary code execution within the PHP process.
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory read in the Dawn (WebGPU) component of Google Chrome before 151.0.7922.72 lets a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Google's Chrome team reported it and a fixed Stable-channel build is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile). Notably, Chromium internally rated the security severity 'Low' even though the NVD-style CVSS base score is 8.1, so real-world impact is likely narrower than the raw score implies.
Out-of-bounds memory access in Google Chrome's Frame component affects all Desktop builds prior to 151.0.7922.72, letting a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Chromium rated the underlying flaw Low severity, yet NVD scores it 8.8 (High) and tags flag potential RCE; there is no public exploit identified at time of analysis and EPSS is a low 0.18% (8th percentile). A vendor patch is available and the issue is not listed in CISA KEV.
Out-of-bounds memory read in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) lets a remote attacker disclose heap memory when a victim opens a crafted HTML page. The flaw is a CWE-122 heap buffer overflow that Chromium itself rated Low severity, with no public exploit identified at time of analysis and an EPSS probability of 0.19% (9th percentile). CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, though technical impact is rated total.
Remote code execution in Google Chrome desktop before 151.0.7922.72 arises from a heap buffer overflow in the browser's media Codecs component (CWE-122), letting a remote attacker who serves a crafted HTML page corrupt heap memory and run arbitrary code - though execution is confined inside the renderer sandbox rather than the host OS. Google rates the Chromium severity as Low despite the NVD-style 8.8 CVSS, and there is no public exploit identified at time of analysis; EPSS is low at 0.24% (15th percentile) and CISA SSVC lists exploitation as none. A vendor patch is available in the 151.0.7922.72 stable channel release.
Out-of-bounds memory read in Chrome's WebXR component allows remote attackers to disclose sensitive renderer process memory or crash the browser tab by luring a victim to a crafted HTML page. All Google Chrome releases prior to 151.0.7922.72 are affected across all platforms, with the vendor confirming a patch in the stable channel update. No public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates low near-term exploitation probability despite the high CVSS base score of 8.1.
Sandbox escape in Google Chrome's media codec handling affects all Chrome desktop builds prior to 151.0.7922.72, where an integer overflow while parsing a maliciously crafted video file can let a remote attacker break out of the renderer sandbox. Exploitation requires the victim to load attacker-controlled media (UI:R), and there is no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the flaw is not on CISA KEV. Notably, Chromium's own triage rated this 'Medium' severity, which conflicts with the NVD-style 9.6 Critical score.
Sandbox escape in Google Chrome's ANGLE graphics layer allows a remote attacker to corrupt memory via a crafted HTML page in versions prior to 151.0.7922.72. The flaw is an out-of-bounds read and write (CWE-125) that a victim triggers simply by visiting a malicious page, potentially letting attacker-controlled code break out of the renderer sandbox. Google has released a fixed stable channel build; there is no public exploit identified at time of analysis and EPSS risk is currently low (0.21%).
Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.
Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.
Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.
Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. Because it requires a pre-compromised renderer, it is typically one link in an exploit chain rather than a single-shot RCE.
Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.
Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.
Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets once an AES-GCM cipher is negotiated during the SSH/SFTP handshake. An unvalidated length field is passed directly to the GCM decrypt routine, overwriting the stack cookie and saved return address before any authentication occurs, potentially yielding code execution as the FTP service. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the pre-auth, network-reachable nature makes it a high priority.
Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write past a heap buffer by sending a malformed SSH client identification string over any SSH or SFTP connection. The flaw is a logic error in the recv-loop termination condition (an OR used where AN AND is required), triggering before authentication and creating strong potential for remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView 2027.0.0 exposes users to application crashes and sensitive memory disclosure when parsing maliciously crafted DWG or DXF files. Exploitation requires a local user to open a weaponized file, making social engineering the primary delivery mechanism targeting CAD operators in AEC and manufacturing environments. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at a negligible 0.12% (2nd percentile), and a vendor patch is available via ADSK-SA-2026-0009.
Arbitrary code execution in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView occurs when a user opens a maliciously crafted DXF file, triggering a heap-based buffer overflow (CWE-122) in the file parser. A local attacker who convinces a victim to open the file can crash the application, read sensitive in-process memory, or run code in the context of the current user. There is no public exploit identified at time of analysis, and the file-format vector plus required user interaction places this in the classic 'malicious drawing file' threat model rather than remote mass exploitation.
Out-of-bounds write in Schneider Electric IGSS (Interactive Graphical SCADA System) Definition module allows an attacker to corrupt memory - causing data loss or potential arbitrary code execution - when a victim imports a maliciously crafted CGF (configuration/definition) file. Exploitation is local and hinges on user interaction (opening/importing the file), with no authentication required once the operator is tricked. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Schneider Electric PSIRT) rates the flaw high at CVSS 8.4.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).
Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.
Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).
Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Opening a malicious file in Adobe Format Plugins can trigger a heap-based buffer overflow, allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported at this time.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote code execution, information disclosure, denial of service, or privilege escalation when processing a malicious WAV file. The flaw resides in the read_WAV_Header() function due to lack of bounds checking on chunk size and bytes-to-skip values, enabling heap corruption. A public proof-of-concept exists (CISA SSVC 'poc'), but no active exploitation has been confirmed in CISA KEV.
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.
Remote heap buffer overflow in the ESP32-audioI2S library 3.4.5 allows unauthenticated attackers to corrupt heap memory, potentially leading to arbitrary code execution or denial of service on affected ESP32 devices. The flaw arises from an unsafe memcpy in AudioBuffer::writeSpace() that copies a full UINT16_MAX bytes without validating the destination buffer size. A public proof-of-concept exists, elevating the urgency for IoT devices using this library.
Denial of service in Schreibfaul1 ESP32-audioI2S version 3.4.5 allows unauthenticated network attackers to crash the audio service by exploiting a buffer overflow in the MP3Decoder::decode() function. Missing validation on untrusted mainDataBegin and nSlots values from incoming MP3 streams leads to memory corruption and service unavailability. No active exploitation or public exploit code has been identified at time of analysis.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to fully compromise a device by sending a malicious MP3 file or stream. The flaw lies in the MP3Decoder::UnpackSFMPEG1 function, which lacks input validation on attacker-controlled MP3 metadata, triggering a classic buffer overflow (CWE-120). A publicly available proof-of-concept exists, although no active exploitation has been confirmed via CISA KEV.
Heap-based buffer overflow in schreibfaul1 ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to corrupt PSRAM memory, leading to denial of service and potential arbitrary code execution. An unchecked unsigned integer overflow when allocating a buffer for audio processing results in an undersized allocation; subsequent read/write operations overrun the heap. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
We are tasked with producing a comprehensive JSON analysis for CVE-2026-51273. We have multiple intelligence sources: mitre (CVE description, CVSS, CWE, references), tags, SSVC, ENISA EUVD. The input provides the CVE ID, description, CVSS score, vector, CWE, and multi-source intel including CPE, references, tags, SSVC, and EUVD data. We must synthesize all this into a JSON object with the specified fields, each a plain text string. First, let's parse all the given data: - CVE ID: CVE-2026-51273 - Description: "In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file." - CVSS Score: 7.8 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-122 (Heap-based Buffer Overflow) - Reported by mitre. - CPE (affected products): cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (this is a placeholder; the real product is schreibfaul1 ESP32-audioI2S, but CPE string is given as "n/a:n/a"). So product is "ESP32-audioI2S" by schreibfaul1. But the CPE doesn't provide a proper string; we'll note that in confidence_notes. - Tags: RCE, Buffer Overflow, N A, Heap Overflow - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. So a proof-of-concept exists, but exploitation is not automatable. - ENISA EUVD: EUVD-2026-49928, affected versions: ["n/a n/a"] (again placeholder). So no specific version range from EUVD, but description says version 3.4.5 is affected. - References: 1. (None) https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp (source code link) 2. (None) https://github.com
Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.
Heap-based buffer overflow in the connecttospeech() function of schreibfaul1 ESP32-audioI2S version 3.4.5 allows remote attackers to achieve arbitrary code execution by supplying an overly long speech text string. The flaw arises because the library performs URL encoding of attacker-controlled input and appends it to a fixed-size heap buffer without length validation, leading to a heap overflow. A public proof-of-concept exploit is available, but active exploitation has not been confirmed.
Heap buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls the audio stream host or URL corrupt memory on the ESP32 microcontroller. The dismantle_host() parser feeds attacker-supplied host, request-host, extension, and query-string segments into clone_from(), which copies them into fixed-size heap buffers without length checks, enabling potential remote code execution or device crash. Rated CVSS 9.8 with SSVC marking technical impact as total and exploitation as automatable, though EPSS is only 0.18% and there is no public exploit identified at time of analysis.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to overflow a heap buffer via crafted HTTP request headers. Public exploit code is available, enabling arbitrary code execution on vulnerable ESP32 devices. No official patch has been released.
Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote attackers to execute arbitrary code, disclose information, crash the service, or escalate privileges by sending a malicious URL with an oversized path and query string to the vulnerable urlencode function. No active exploitation has been confirmed by CISA KEV, and no EPSS score is available at this time.
A heap-based buffer overflow in ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to crash or potentially execute arbitrary code on vulnerable ESP32 devices. The flaw exists in the Audio::openai_speech function, which manually constructs JSON/HTTP payloads by concatenating user input without length checks. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in ESP32-audioI2S 3.4.5’s ID3v2 APIC frame parser lets remote attackers execute arbitrary code or crash vulnerable devices by supplying a crafted MP3 file. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in ESP32-audioI2S 3.4.5 allows remote attackers to cause denial of service, information disclosure, or arbitrary code execution via a crafted MP3 file. Public exploit code is available but no active exploitation is confirmed.
Out-of-bounds read in macOS allows a malicious app to trigger unexpected system termination. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates low probability of widespread exploitation.
Connecting to a malicious SMB server can cause unexpected system termination in macOS due to a memory handling vulnerability (CWE-119). The issue affects all macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 and has been addressed with improved memory handling. No known active exploitation or public exploit code exists, and the EPSS probability of exploitation is very low (0.15%).
Buffer overflow in Apple macOS allows a malicious app to cause unexpected system termination. Affects macOS versions prior to 26.6 (Tahoe). No active exploitation or public exploit code is known, and EPSS indicates a low 0.15% probability of exploitation.
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
Unexpected system termination in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 allows a local application to trigger a denial-of-service via an out-of-bounds read. No active exploitation or public exploit is known, and EPSS indicates a low exploitation probability. The high CVSS score likely overstates the risk, as only a crash is confirmed in the description.
Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
Memory corruption in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local app to cause unexpected system termination or corrupt kernel memory. Despite a CVSS score of 9.8, the attack vector is local and no public exploit or active exploitation has been identified; EPSS estimates exploitation probability at 0.16%, and CISA SSVC confirms no current exploitation but notes the issue is automatable with total technical impact.
Memory corruption in macOS may allow a malicious app to corrupt the memory of a system process, potentially leading to arbitrary code execution. This issue is fixed in macOS Sonoma 14.8.8 and macOS Tah
Denial-of-service
Out-of-bounds read in macOS allows an attacker to crash applications and potentially access sensitive memory by tricking a user into opening a maliciously crafted file. Affecting macOS Son
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Kernel memory corruption in macOS allows remote code execution with high impact on confidentiality, integrity, and availability. A buffer overflow vulnerability allows network-based attackers to execute arbitrary code with kernel privileges, potentially compromising the system. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and while no active exploitation has been reported, the remotely exploitable nature without authentication makes patching critical.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.
Local kernel memory read in macOS via a buffer overflow, fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. A local user with low privileges can trigger the overflow to read sensitive kernel data, potentially leaking encryption keys or credentials. No active exploitation or public exploit code is known.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Kernel memory corruption in Apple macOS allows a remote, unauthenticated attacker to crash the system or corrupt kernel memory on hosts running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Apple's advisory attributes the flaw to insufficient bounds checking (CWE-120), and although the vendor rates it 9.8 with full confidentiality, integrity, and availability impact, our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - the demonstrated outcome is denial of service through kernel termination or memory corruption, with code execution not proven and the triggering service, protocol, or listener undisclosed. No public exploit has been identified at time of analysis, EPSS is low (0.26%, 18th percentile), and CISA's SSVC records exploitation as 'none'; vendor-released patches are available, so remediation should be prioritized on network-exposed macOS hosts rather than treated as an emergency active-exploitation event.
An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.
Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.
Buffer overflow in macOS versions prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to escape its
Kernel memory corruption vulnerability in Apple macOS allows a remote unauthenticated attacker to cause unexpected system termination or potentially execute arbitrary code with kernel privileges. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Although EPSS indicates low exploitation likelihood and no active exploitation or public exploit is reported, the critical CVSS score and network attack vector make patching a priority.
Local kernel memory disclosure and denial-of-service vulnerability in macOS 14.x and 15.x prior to patches. An unauthenticated attacker with local access can trigger a memory handling flaw to read kernel memory or cause unexpected system termination. No active exploitation or public exploit code is known; EPSS score is very low (0.14%).
We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a