Buffer Overflow
Monthly
Information disclosure in Google Chrome prior to 150.0.7871.128 allows a remote attacker to leak sensitive data after luring a user to a malicious web page, per the Chrome stable channel update. The CVSS 3.1 score of 8.8 reflects network reach with only user interaction required, and a vendor patch is available. No public exploit identified at time of analysis, and EPSS estimates a low ~0.29% probability of near-term exploitation.
Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).
Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.
Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.
Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.
Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.
Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).
Out-of-bounds kernel memory read in the Linux kernel's Soft-iWARP (siw) RDMA driver lets a malicious connected iWARP peer send an MPA FPDU whose 16-bit length field is smaller than the fixed DDP/RDMAP header, triggering a signed-integer underflow that propagates a negative length into skb_copy_bits() as a huge size_t, producing a multi-gigabyte use-after-free read. Affected are kernels from 5.3 up to the fixed stable releases wherever the siw module is loaded; the primary outcome is a kernel crash (denial of service) with potential exposure of adjacent kernel memory. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with the niche siw attack surface despite the high CVSS.
Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.
Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.
Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.
Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.
Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.
Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).
A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.
Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.
Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.
Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.
Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Kernel memory corruption in the Linux iwlwifi 'mld' Wi-Fi driver occurs when AMSDU is disabled for a traffic ID and the TSO segmentation path (iwl_mld_tx_tso_segment) fails to detect the sentinel value max_tid_amsdu_len == 1, producing gso_size = 0 and exploding a single GSO skb into ~32,000 tiny segments that flood the TX ring and trigger a use-after-free (refcount underflow) in TCP's retransmit queue. Only the newer 'mld' driver is affected; the legacy 'mvm' driver is immune because it checks amsdu_enabled first. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available.
Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.
Out-of-bounds array access in the Linux kernel's Microsoft Azure Network Adapter (mana) driver lets a malicious hypervisor corrupt guest kernel memory within Confidential VMs. In mana_hwc_rx_event_handler(), the rx_req_idx index is read from host-shared DMA-coherent memory (a WQE's sge->address) without a bounds check, so in SEV-SNP/TDX guests the untrusted host can steer the index to read/write past the reqs[] array. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a defense-in-depth hardening fix for the confidential-computing threat model rather than an actively exploited flaw.
Out-of-bounds memory access in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem allows a crafted, truncated supervision frame to trigger an OOB read when the code accesses a TLV header that was not fully linearized into the socket buffer. The flaw affects systems running the net/hsr driver across numerous stable kernel branches (fixed in 6.1.176, 6.6.143, 6.12.93, 6.18.35 and others). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a niche, protocol-specific attack surface rather than broad exploitation.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.
Out-of-bounds heap corruption in the Linux kernel's IPv6 RPL Source Routing Header handling (net/ipv6/exthdrs.c) allows remote attackers to corrupt the routing header of forwarded packets by sending a crafted compressed SRH. The bug stems from a __u8 truncation of the computed hdrlen in ipv6_rpl_srh_decompress(): with n=127 segments the value (128*16)>>3 = 256 wraps to 0, causing the compressed header to overlap the decompressed region so ipv6_rpl_srh_compress() writes into kernel memory it should not. Rated CVSS 9.8 but EPSS is only 0.18% (7th percentile); no public exploit and no CISA KEV listing exist at time of analysis, and exploitation requires an unrealistic 127-segment header on a node with RPL source routing enabled.
Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.
Host-side buffer overflow in the Linux kernel's KVM AMD SEV/SEV-ES support (arch/x86/kvm/svm/sev.c GHCB handling) lets a malicious or compromised confidential guest corrupt host memory by abusing Page State Change (PSC) requests. KVM miscomputes the maximum length of the in-GHCB scratch area, treating the guest-supplied @len as the buffer's full size when for PSC it is only a minimum, allowing a guest to drive writes past the shared GHCB buffer. Rated CVSS 9.3 for a scope-changed guest-to-host escape; no public exploit is identified at time of analysis and EPSS is low (0.22%), but a vendor patch is available across multiple stable branches.
MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Information disclosure (slab-out-of-bounds read) in the Linux kernel IPv6 datagram stack lets a local unprivileged attacker leak adjacent kernel slab memory and potentially crash the system. The flaw lives in ip6_datagram_recv_specific_ctl(), which trusts the on-wire extension-header length byte when building IPV6_HOPOPTS/DSTOPTS/RTHDR control messages; because nftables is reachable from an unprivileged user namespace, an attacker can rewrite that length after parse-time validation and force put_cmsg() to copy up to 2040 bytes from an 8-byte header. There is no public exploit and it is not in CISA KEV (EPSS 0.21%), so risk is credible but not yet demonstrated at scale.
Out-of-bounds kernel write in the Linux `wacom` HID driver affects the `wacom_hid_set_device_mode()` routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of `r->field[0]->value`, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.
Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.
Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.
Remote denial-of-service and slab corruption in the Linux kernel iSCSI target (LIO) subsystem affects the Text-phase command handler iscsit_handle_text_cmd(), where two latent bugs have existed since the original LIO integration (commit e48354ce078c). A CRC32C overread reads four bytes past a kzalloc'd buffer on every Text PDU when DataDigest=CRC32C is negotiated, and a stale cmd->text_in_ptr causes a double-free on ErrorRecoveryLevel>0 bad-DataDigest drops and at session teardown. On distro kernels built with CONFIG_SLAB_FREELIST_HARDENED=y (the default) the double-free becomes a remote kernel BUG(); on non-hardened builds it corrupts the slab freelist. No public exploit identified at time of analysis, though the flaw is directly reproducible under KASAN; not listed in CISA KEV and EPSS is low (0.22%).
Heap buffer overflow in the Linux kernel iSCSI target (LIO/TCM) subsystem lets a remote attacker who can reach the target's login service corrupt kernel memory during login text-key negotiation. The iscsi_encode_text_output() path performs unbounded sprintf() concatenation of "key=NotUnderstood" response records into a fixed 8 KiB login->rsp_buf, and a single Login PDU packed with ~2048 minimal unknown key/value pairs expands to roughly 32 KiB of output, producing a ~24 KiB overrun in the kmalloc-8k slab. CVSS is rated 9.8, but EPSS is low (0.22%, 13th percentile); no public exploit is identified at time of analysis and it is not on CISA KEV.
Heap out-of-bounds write in the Linux kernel iSCSI target (LIO) driver lets a remote attacker overflow the heap-allocated client_digest buffer by supplying an over-length BASE64-encoded CHAP_R response during login. chap_server_compute_hash() decodes up to 127 base64 characters (95 bytes) into a buffer sized to the digest (32 bytes for SHA-256, 16 for MD5), overflowing it by 63-79 bytes before the too-late length check at line 344. The input assigns CVSS 9.8; however EPSS is low (0.21%, 11th percentile), it is not in CISA KEV, and no public exploit was identified - indicating a serious memory-corruption bug that is not yet being exploited.
Local memory corruption in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) stems from an integer overflow in the KFD debugger's get_queue_ids() routine, where num_queues * sizeof(uint32_t) can wrap on 32-bit size_t builds and produce an undersized allocation. A local user with access to the KFD debug interface can trigger kernel heap corruption impacting confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.22%, 12th percentile) and it is not on CISA KEV, but a vendor patch has been released across multiple stable trees.
A shift-out-of-bounds (undefined behavior) exists in the Linux kernel's mac80211 wireless stack, in ieee80211_parse_tx_radiotap(), where an 8-bit IEEE80211_RADIOTAP_ANTENNA value from a userspace-injected frame is used directly as a BIT() shift count, allowing shifts of up to 255 on a 64-bit unsigned long. A local user able to inject frames on a monitor-mode interface can trigger the UB, flagged by UBSAN, with no public exploit identified at time of analysis and a low EPSS score (0.16%, 5th percentile). The realistic impact is undefined behavior / potential instability rather than the memory-corruption RCE implied by the assigned 7.6 CVSS.
Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.
Out-of-bounds kernel memory read in the Linux kernel's f2fs filesystem driver allows an attacker who can get a crafted f2fs image mounted to leak kernel memory and crash the system. When the flexible_inline_xattr feature is enabled, do_read_inode() trusts the on-disk i_inline_xattr_size for inodes that carry inline dentries or inline data but lack the FI_INLINE_XATTR flag, so an unvalidated, attacker-controlled size drives inode geometry negative and produces an out-of-bounds read in f2fs_fill_dentries() when the inline directory is read. EPSS is low (0.16%, 5th percentile) and there is no public exploit identified at time of analysis nor CISA KEV listing; a vendor patch is available.
Out-of-bounds heap read in the Linux kernel's F2FS filesystem lets a local low-privileged user disclose adjacent kernel memory or crash the system by reading POSIX ACLs from a maliciously crafted f2fs image. The flaw lives in f2fs_acl_from_disk() (fs/f2fs/acl.c), which dereferences an ACL entry's e_id before confirming a full f2fs_acl_entry fits in the xattr buffer. It is fixed upstream, carries CVSS 7.8, and shows a very low EPSS (0.17%, 6th percentile); there is a KASAN crash reproducer in the report but no public weaponized exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Out-of-bounds read in the Linux kernel's KVM x86 shadow MMU allows a malicious or misbehaving guest to trigger a host kernel page fault (crash) during hugepage recovery. The flaw occurs when the KVM host recovers hugepages and queries the max mapping level for a direct shadow page whose base gfn falls outside the target memslot, causing an out-of-bounds access into the vmalloc'd lpage_info array. Rated CVSS 8.8 (local, scope-changed) but with low real-world exploitation probability (EPSS 0.17%); no public exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Local memory corruption in the Linux kernel scheduler's per-mm concurrency-ID (mm_cid) subsystem lets an unprivileged task trigger a deterministic out-of-bounds single-bit clear in kernel memory. The flaw lives in mm_cid_fixup_cpus_to_tasks(), where a task whose CID is still the MM_CID_UNSET sentinel (BIT(31)) is wrongly marked in-transit and later fed to clear_bit(), clearing a bit 256 MiB past the mm_struct CID bitmap. It was surfaced by syzkaller as a KASAN use-after-free in __schedule; no public weaponized exploit and no CISA KEV listing exist at time of analysis.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.
Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.
Kernel memory disclosure in the Linux kernel fbcon (framebuffer console) subsystem allows a local low-privileged attacker to trigger an out-of-bounds read by exploiting incomplete error-path rollback in fbcon_do_set_font(). When a font-set operation fails partway (e.g., vc_resize() allocation failure under memory pressure), the hi_font_mask and screen buffer are left desynchronized from the reverted 256-character font array, causing the VT subsystem to render character indices above 255 against undersized data. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available across multiple stable branches.
Heap out-of-bounds read in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client leak kernel heap memory or crash the server on shares that use ACL xattrs. The flaw lives in smb_check_perm_dacl(), which validates an ACE header and caps sub-authority count but never confirms the ACE is large enough to hold those sub-authorities before compare_sids() dereferences them. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a memory-disclosure/DoS bug rather than a mass-exploited RCE.
Out-of-bounds array read in the Linux kernel's IIO veml6075 UV light sensor driver allows a local low-privileged user reading the sensor's integration-time data to trigger access past the 5-element veml6075_it_ms lookup table. The VEML6075_CONF_IT register field can decode to index values 0-7, but only indices 0-4 are valid; a reserved value (5-7) drives the driver to read beyond the array. This is a hardening fix against faulty hardware, device misprogramming, or bus corruption rather than a directly attacker-controllable memory-corruption primitive; no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Out-of-bounds array read in the Linux kernel's TI ADS1298 IIO ADC driver (ti-ads1298) lets a local, low-privileged actor read past the 7-element ads1298_pga_settings table when a channel's PGA field decodes to the reserved value 7 (0b111). Affected are systems running the ti-ads1298 driver against a TI ADS1298 biopotential/ECG analog front end; the upstream fix adds a bounds check that returns -EINVAL. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a niche, hardware-dependent code path rather than a broadly weaponizable flaw.
Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.
Stack-based buffer overflow in Shibby Tomato 1.28 router firmware lets an authenticated attacker corrupt memory through the Scheduler Name Handler (function sub_42537C) by supplying an overlong scheduler-name argument, enabling likely remote code execution on the device. The affected build is a niche, community-maintained MIPS router firmware distribution that has been retired and superseded by FreshTomato. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the VulDB-assigned CVSS 4.0 score is 8.7.
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.
Heap-based buffer overflow in IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 and 8.2.0.0-8.2.1.0) lets a remote attacker corrupt heap memory through improper bounds checking, potentially achieving arbitrary code execution or crashing the affected process. The flaw carries a CVSS 3.1 base score of 9.8, but no public exploit identified at time of analysis and the EPSS probability is low (0.46%, 37th percentile). Note that the affected component is the backup Client, while the description references crashing 'the server,' introducing ambiguity about the true exploitation path.
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Acrobat Reader arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. All affected versions covered by Adobe advisory APSB26-63 are impacted, and successful exploitation grants full high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk is currently latent rather than active.
Denial of service in Wazuh's analysis engine (wazuh-analysisd) lets an unauthenticated remote attacker permanently halt SIEM alert processing on Wazuh manager versions 1.0.0 through 4.14.4. Because the official wazuh/wazuh-docker deployment ships with password-less agent enrollment enabled by default, an attacker can register as an agent and send a crafted rootcheck event that overflows a fixed 30-byte heap buffer, crashing the daemon while the dashboard and API keep showing stale data - silently blinding the SIEM. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Memory-disclosure via heap buffer overflow in libjxl (the JPEG XL reference codec) versions 0.11.2 and earlier lets an attacker who supplies a crafted APNG image trigger an out-of-bounds access in the DecodeImageAPNG function, leaking sensitive process memory. The upstream fix (PR #4804) adds a missing row-index bounds check before accessing frame rows. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and the issue is not listed in CISA KEV.
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in Microsoft Windows Terminal allows an unauthenticated attacker to run arbitrary code by tricking a user into interacting with malicious content that triggers an integer overflow (CWE-190). The flaw carries a CVSS 7.5 rating driven by high complexity and required user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Microsoft has released a patch through the MSRC update guide.
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger a one-byte over-read in the bundled libsyck lexer, with a total (per SSVC) technical impact of information disclosure or process crash. The flaw sits in newline_len/is_newline, which dereference the scan pointer (and the following byte for a "\r\n" pair) with no NUL-terminator or bounds check, so a block scalar sitting at a document boundary runs one byte past the heap lexer buffer. There is no public exploit identified at time of analysis and it is not in CISA KEV, but CPANSec-documented trigger inputs exist and it is explicitly an incomplete fix of CVE-2025-11683 on a lexer path the earlier patch missed.
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feeding a crafted YAML document to Load or LoadFile. The bundled libsyck base64 decoder (syck_base64dec) indexes its 256-entry b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table; because !!binary is a standard tag processed on the default Load path (not gated by $LoadBlessed or $LoadCode), the flaw is reachable without any opt-in. No CISA KEV listing and EPSS is low (0.19%, 8th percentile), so no public weaponized exploit is identified at time of analysis, though the exact trigger strings (e.g. '--- !!binary \x80\x80\x80\x80') are publicly documented in the vendor's CI test suite and the oss-security advisory.
Local privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write (CWE-787) reachable through a crafted IOCTL request to a privileged kernel-mode component, corrupting kernel memory. An authenticated local attacker on an engineering workstation running the software can leverage the corruption to escalate to SYSTEM/kernel privileges or crash the host. No public exploit identified at time of analysis; the flaw is documented in CISA ICS advisory ICSA-26-197-04 (reported by ICS-CERT) but is not listed in CISA KEV, and no EPSS score was supplied.
Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel memory by issuing a crafted IOCTL request to an out-of-bounds write flaw (CWE-787). Successful exploitation can elevate privileges to SYSTEM/kernel level or crash the host running this engineering workstation software for AutomationDirect Productivity-series PLCs. Reported through CISA ICS-CERT (ICSA-26-197-04); no public exploit identified at time of analysis and no KEV/EPSS signal is present.
Remote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet with malformed address parameters to trigger an out-of-bounds access during packet classification, potentially leading to remote code execution or a kernel panic. The flaw affects illumos-gate and downstream distributions (OmniOS, SmartOS/Triton) built before commit 53a3efde, and has existed since 2010 (commit a5407c02). There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is Unreported (E:U), but the attack requires no authentication or user interaction.
Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing process or disclose small amounts of adjacent process memory by feeding it a truncated or malformed XML document. The parserc_parse C routine performs multi-character lookahead (for tokens like '<![CDATA[' and element terminators) without verifying the offsets stay inside the input buffer, so inputs such as '<a/' read past the end. There is no public exploit identified at time of analysis and EPSS is low (0.19%), but SSVC rates the flaw automatable, reflecting how easily malformed XML can be delivered to any service that parses untrusted input with this module.
Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated or malformed HTML - such as the string "<a/" - force the C-based parserc_parse routine to read past the end of the input buffer. Because the parser performs multi-character lookahead for tokens like "<![CDATA" and element terminators ">" without bounds checks, adjacent heap memory can be disclosed or the process can crash. No public exploit was identified at time of analysis, but an upstream fix (GitHub PR #2) and per-version patches are available.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Out-of-bounds heap write in Tencent's ncnn neural-network inference framework allows a crafted .param model file to corrupt heap memory when parsed by Net::load_param(). Because ParamDict::load_param() and load_param_bin() validated the parsed parameter id only against the upper bound (id >= NCNN_MAX_PARAM_COUNT), a negative id indexes before the params[] array, giving an attacker a write primitive below the allocated buffer. No public exploit is identified at time of analysis and the issue is not in CISA KEV; an upstream source-code fix is available.
Denial of service in TDengine time-series database versions prior to 3.4.1.15 allows unauthenticated remote attackers to crash the server by sending a malformed compressed RPC packet. The transDecompressMsg() function trusts a compression-length field without verifying the packet is large enough to contain the 8-byte STransCompMsg header, leading to an out-of-bounds read, uncontrolled/underflowed allocation, and process crash. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; a vendor fix exists in 3.4.1.15.
Stack-based buffer overflow in TDengine (open-source IoT time-series database) versions 3.4.1.6 and earlier allows an authenticated user to trigger a one-byte out-of-bounds write by submitting SQL containing crafted escape sequences (\%, \_, or \x), leading to denial of service and potentially remote code execution. The flaw sits in the SQL parser's trimString() routine, which validates only a single byte of remaining space in the tmpTokenBuf stack buffer before writing escape-processed data. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in version 3.4.1.14.
Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.
Memory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an internal security review, are scored CVSS 9.8 and could let remote unauthenticated attackers trigger buffer-overflow conditions on Cisco video collaboration endpoints. Per the CVSS vector the flaw is network-reachable with no authentication or user interaction and yields total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed exploitation despite the critical score.
Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (DoS) and, on hosts with ASLR disabled or bypassed, potentially execute arbitrary code by sending crafted HTTP requests. The flaw is a data-plane-only issue triggered when a regex-based map directive references the map's regex capture variables before the map output variable in a string expression, or via a non-cacheable variable under certain conditions. F5 has released a patched version; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted archive on 7-Zip 26.01 and earlier; fixed in 7-Zip 26.02. Reported by Landon Peng of Lunbun LLC through the Zero Day Initiative, this flaw carries full confidentiality, integrity, and availability impact at the process level. A public POC is confirmed available via the Italian ACN portal, though EPSS sits at only 0.92% (57th percentile) and no CISA KEV listing exists, indicating targeted rather than widespread exploitation at time of analysis.
Heap-based buffer overflow in NTFS-3G through 2026.2.25 enables a local attacker to corrupt heap memory inside the SUID-root ntfs-3g binary by supplying a crafted NTFS image, with potential for privilege escalation to root. The flaw in build_inherited_id() (libntfs-3g/security.c) is triggered when a file is created inside a specially structured directory on the malicious volume. No public exploit identified at time of analysis; vendor patches are confirmed available for Ubuntu and SUSE.
Remote code execution or permanent denial of service in the Tenda AC10 v3 SOHO router (firmware V03.03.16.09) stems from a classic buffer overflow reachable through the /cgi-bin/UploadCfg web endpoint. Attackers who can reach the router's management interface can send oversized crafted input to crash the device permanently or potentially run arbitrary code on it. Proof-of-concept material appears to be published on GitHub, though this is not listed in CISA KEV and carries a low EPSS score of 0.17% (7th percentile), indicating no confirmed widespread exploitation yet.
Heap out-of-bounds read/write in OpenHTJ2K (High-Throughput JPEG 2000 reference codec) v0.18.4 and earlier lets an attacker corrupt heap memory by supplying a crafted J2K/JP2 codestream, with a confirmed heap information-leak primitive and vendor-claimed arbitrary code execution. The flaw is reached through every decoder entry point (invoke, invoke_line_based, invoke_line_based_stream, invoke_line_based_predecoded) and, notably, through a JPIP server's startup codestream load, making it network-reachable without user interaction. There is no public exploit identified at time of analysis, though the vendor changelog references non-public PoC files, and the issue is not listed in CISA KEV.
Arbitrary code execution in OpenHTJ2K (an open-source High Throughput JPEG 2000 codec by osamu620) versions 0.18.4 and earlier stems from an unchecked coding-pass counter overflowing the fixed pass_length[128] array while parsing crafted JPEG 2000 packet headers. An attacker who supplies a malicious J2K/HTJ2K image to an application built on the library can corrupt adjacent memory and potentially execute code. No public exploit identified at time of analysis; EPSS is low (0.20%) and CISA SSVC rates current exploitation as none, though technical impact is total and the flaw is automatable.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing and requires user interaction, so it is not remotely exploitable without victim action. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Information disclosure in Google Chrome prior to 150.0.7871.128 allows a remote attacker to leak sensitive data after luring a user to a malicious web page, per the Chrome stable channel update. The CVSS 3.1 score of 8.8 reflects network reach with only user interaction required, and a vendor patch is available. No public exploit identified at time of analysis, and EPSS estimates a low ~0.29% probability of near-term exploitation.
Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).
Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.
Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.
Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.
Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.
Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).
Out-of-bounds kernel memory read in the Linux kernel's Soft-iWARP (siw) RDMA driver lets a malicious connected iWARP peer send an MPA FPDU whose 16-bit length field is smaller than the fixed DDP/RDMAP header, triggering a signed-integer underflow that propagates a negative length into skb_copy_bits() as a huge size_t, producing a multi-gigabyte use-after-free read. Affected are kernels from 5.3 up to the fixed stable releases wherever the siw module is loaded; the primary outcome is a kernel crash (denial of service) with potential exposure of adjacent kernel memory. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with the niche siw attack surface despite the high CVSS.
Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.
Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.
Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.
Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.
Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.
Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).
A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.
Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.
Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.
Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.
Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Kernel memory corruption in the Linux iwlwifi 'mld' Wi-Fi driver occurs when AMSDU is disabled for a traffic ID and the TSO segmentation path (iwl_mld_tx_tso_segment) fails to detect the sentinel value max_tid_amsdu_len == 1, producing gso_size = 0 and exploding a single GSO skb into ~32,000 tiny segments that flood the TX ring and trigger a use-after-free (refcount underflow) in TCP's retransmit queue. Only the newer 'mld' driver is affected; the legacy 'mvm' driver is immune because it checks amsdu_enabled first. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available.
Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.
Out-of-bounds array access in the Linux kernel's Microsoft Azure Network Adapter (mana) driver lets a malicious hypervisor corrupt guest kernel memory within Confidential VMs. In mana_hwc_rx_event_handler(), the rx_req_idx index is read from host-shared DMA-coherent memory (a WQE's sge->address) without a bounds check, so in SEV-SNP/TDX guests the untrusted host can steer the index to read/write past the reqs[] array. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a defense-in-depth hardening fix for the confidential-computing threat model rather than an actively exploited flaw.
Out-of-bounds memory access in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem allows a crafted, truncated supervision frame to trigger an OOB read when the code accesses a TLV header that was not fully linearized into the socket buffer. The flaw affects systems running the net/hsr driver across numerous stable kernel branches (fixed in 6.1.176, 6.6.143, 6.12.93, 6.18.35 and others). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a niche, protocol-specific attack surface rather than broad exploitation.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.
Out-of-bounds heap corruption in the Linux kernel's IPv6 RPL Source Routing Header handling (net/ipv6/exthdrs.c) allows remote attackers to corrupt the routing header of forwarded packets by sending a crafted compressed SRH. The bug stems from a __u8 truncation of the computed hdrlen in ipv6_rpl_srh_decompress(): with n=127 segments the value (128*16)>>3 = 256 wraps to 0, causing the compressed header to overlap the decompressed region so ipv6_rpl_srh_compress() writes into kernel memory it should not. Rated CVSS 9.8 but EPSS is only 0.18% (7th percentile); no public exploit and no CISA KEV listing exist at time of analysis, and exploitation requires an unrealistic 127-segment header on a node with RPL source routing enabled.
Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.
Host-side buffer overflow in the Linux kernel's KVM AMD SEV/SEV-ES support (arch/x86/kvm/svm/sev.c GHCB handling) lets a malicious or compromised confidential guest corrupt host memory by abusing Page State Change (PSC) requests. KVM miscomputes the maximum length of the in-GHCB scratch area, treating the guest-supplied @len as the buffer's full size when for PSC it is only a minimum, allowing a guest to drive writes past the shared GHCB buffer. Rated CVSS 9.3 for a scope-changed guest-to-host escape; no public exploit is identified at time of analysis and EPSS is low (0.22%), but a vendor patch is available across multiple stable branches.
MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Information disclosure (slab-out-of-bounds read) in the Linux kernel IPv6 datagram stack lets a local unprivileged attacker leak adjacent kernel slab memory and potentially crash the system. The flaw lives in ip6_datagram_recv_specific_ctl(), which trusts the on-wire extension-header length byte when building IPV6_HOPOPTS/DSTOPTS/RTHDR control messages; because nftables is reachable from an unprivileged user namespace, an attacker can rewrite that length after parse-time validation and force put_cmsg() to copy up to 2040 bytes from an 8-byte header. There is no public exploit and it is not in CISA KEV (EPSS 0.21%), so risk is credible but not yet demonstrated at scale.
Out-of-bounds kernel write in the Linux `wacom` HID driver affects the `wacom_hid_set_device_mode()` routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of `r->field[0]->value`, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.
Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.
Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.
Remote denial-of-service and slab corruption in the Linux kernel iSCSI target (LIO) subsystem affects the Text-phase command handler iscsit_handle_text_cmd(), where two latent bugs have existed since the original LIO integration (commit e48354ce078c). A CRC32C overread reads four bytes past a kzalloc'd buffer on every Text PDU when DataDigest=CRC32C is negotiated, and a stale cmd->text_in_ptr causes a double-free on ErrorRecoveryLevel>0 bad-DataDigest drops and at session teardown. On distro kernels built with CONFIG_SLAB_FREELIST_HARDENED=y (the default) the double-free becomes a remote kernel BUG(); on non-hardened builds it corrupts the slab freelist. No public exploit identified at time of analysis, though the flaw is directly reproducible under KASAN; not listed in CISA KEV and EPSS is low (0.22%).
Heap buffer overflow in the Linux kernel iSCSI target (LIO/TCM) subsystem lets a remote attacker who can reach the target's login service corrupt kernel memory during login text-key negotiation. The iscsi_encode_text_output() path performs unbounded sprintf() concatenation of "key=NotUnderstood" response records into a fixed 8 KiB login->rsp_buf, and a single Login PDU packed with ~2048 minimal unknown key/value pairs expands to roughly 32 KiB of output, producing a ~24 KiB overrun in the kmalloc-8k slab. CVSS is rated 9.8, but EPSS is low (0.22%, 13th percentile); no public exploit is identified at time of analysis and it is not on CISA KEV.
Heap out-of-bounds write in the Linux kernel iSCSI target (LIO) driver lets a remote attacker overflow the heap-allocated client_digest buffer by supplying an over-length BASE64-encoded CHAP_R response during login. chap_server_compute_hash() decodes up to 127 base64 characters (95 bytes) into a buffer sized to the digest (32 bytes for SHA-256, 16 for MD5), overflowing it by 63-79 bytes before the too-late length check at line 344. The input assigns CVSS 9.8; however EPSS is low (0.21%, 11th percentile), it is not in CISA KEV, and no public exploit was identified - indicating a serious memory-corruption bug that is not yet being exploited.
Local memory corruption in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) stems from an integer overflow in the KFD debugger's get_queue_ids() routine, where num_queues * sizeof(uint32_t) can wrap on 32-bit size_t builds and produce an undersized allocation. A local user with access to the KFD debug interface can trigger kernel heap corruption impacting confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.22%, 12th percentile) and it is not on CISA KEV, but a vendor patch has been released across multiple stable trees.
A shift-out-of-bounds (undefined behavior) exists in the Linux kernel's mac80211 wireless stack, in ieee80211_parse_tx_radiotap(), where an 8-bit IEEE80211_RADIOTAP_ANTENNA value from a userspace-injected frame is used directly as a BIT() shift count, allowing shifts of up to 255 on a 64-bit unsigned long. A local user able to inject frames on a monitor-mode interface can trigger the UB, flagged by UBSAN, with no public exploit identified at time of analysis and a low EPSS score (0.16%, 5th percentile). The realistic impact is undefined behavior / potential instability rather than the memory-corruption RCE implied by the assigned 7.6 CVSS.
Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.
Out-of-bounds kernel memory read in the Linux kernel's f2fs filesystem driver allows an attacker who can get a crafted f2fs image mounted to leak kernel memory and crash the system. When the flexible_inline_xattr feature is enabled, do_read_inode() trusts the on-disk i_inline_xattr_size for inodes that carry inline dentries or inline data but lack the FI_INLINE_XATTR flag, so an unvalidated, attacker-controlled size drives inode geometry negative and produces an out-of-bounds read in f2fs_fill_dentries() when the inline directory is read. EPSS is low (0.16%, 5th percentile) and there is no public exploit identified at time of analysis nor CISA KEV listing; a vendor patch is available.
Out-of-bounds heap read in the Linux kernel's F2FS filesystem lets a local low-privileged user disclose adjacent kernel memory or crash the system by reading POSIX ACLs from a maliciously crafted f2fs image. The flaw lives in f2fs_acl_from_disk() (fs/f2fs/acl.c), which dereferences an ACL entry's e_id before confirming a full f2fs_acl_entry fits in the xattr buffer. It is fixed upstream, carries CVSS 7.8, and shows a very low EPSS (0.17%, 6th percentile); there is a KASAN crash reproducer in the report but no public weaponized exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Out-of-bounds read in the Linux kernel's KVM x86 shadow MMU allows a malicious or misbehaving guest to trigger a host kernel page fault (crash) during hugepage recovery. The flaw occurs when the KVM host recovers hugepages and queries the max mapping level for a direct shadow page whose base gfn falls outside the target memslot, causing an out-of-bounds access into the vmalloc'd lpage_info array. Rated CVSS 8.8 (local, scope-changed) but with low real-world exploitation probability (EPSS 0.17%); no public exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Local memory corruption in the Linux kernel scheduler's per-mm concurrency-ID (mm_cid) subsystem lets an unprivileged task trigger a deterministic out-of-bounds single-bit clear in kernel memory. The flaw lives in mm_cid_fixup_cpus_to_tasks(), where a task whose CID is still the MM_CID_UNSET sentinel (BIT(31)) is wrongly marked in-transit and later fed to clear_bit(), clearing a bit 256 MiB past the mm_struct CID bitmap. It was surfaced by syzkaller as a KASAN use-after-free in __schedule; no public weaponized exploit and no CISA KEV listing exist at time of analysis.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.
Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.
Kernel memory disclosure in the Linux kernel fbcon (framebuffer console) subsystem allows a local low-privileged attacker to trigger an out-of-bounds read by exploiting incomplete error-path rollback in fbcon_do_set_font(). When a font-set operation fails partway (e.g., vc_resize() allocation failure under memory pressure), the hi_font_mask and screen buffer are left desynchronized from the reverted 256-character font array, causing the VT subsystem to render character indices above 255 against undersized data. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available across multiple stable branches.
Heap out-of-bounds read in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client leak kernel heap memory or crash the server on shares that use ACL xattrs. The flaw lives in smb_check_perm_dacl(), which validates an ACE header and caps sub-authority count but never confirms the ACE is large enough to hold those sub-authorities before compare_sids() dereferences them. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a memory-disclosure/DoS bug rather than a mass-exploited RCE.
Out-of-bounds array read in the Linux kernel's IIO veml6075 UV light sensor driver allows a local low-privileged user reading the sensor's integration-time data to trigger access past the 5-element veml6075_it_ms lookup table. The VEML6075_CONF_IT register field can decode to index values 0-7, but only indices 0-4 are valid; a reserved value (5-7) drives the driver to read beyond the array. This is a hardening fix against faulty hardware, device misprogramming, or bus corruption rather than a directly attacker-controllable memory-corruption primitive; no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Out-of-bounds array read in the Linux kernel's TI ADS1298 IIO ADC driver (ti-ads1298) lets a local, low-privileged actor read past the 7-element ads1298_pga_settings table when a channel's PGA field decodes to the reserved value 7 (0b111). Affected are systems running the ti-ads1298 driver against a TI ADS1298 biopotential/ECG analog front end; the upstream fix adds a bounds check that returns -EINVAL. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a niche, hardware-dependent code path rather than a broadly weaponizable flaw.
Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.
Stack-based buffer overflow in Shibby Tomato 1.28 router firmware lets an authenticated attacker corrupt memory through the Scheduler Name Handler (function sub_42537C) by supplying an overlong scheduler-name argument, enabling likely remote code execution on the device. The affected build is a niche, community-maintained MIPS router firmware distribution that has been retired and superseded by FreshTomato. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the VulDB-assigned CVSS 4.0 score is 8.7.
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.
Heap-based buffer overflow in IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 and 8.2.0.0-8.2.1.0) lets a remote attacker corrupt heap memory through improper bounds checking, potentially achieving arbitrary code execution or crashing the affected process. The flaw carries a CVSS 3.1 base score of 9.8, but no public exploit identified at time of analysis and the EPSS probability is low (0.46%, 37th percentile). Note that the affected component is the backup Client, while the description references crashing 'the server,' introducing ambiguity about the true exploitation path.
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Acrobat Reader arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. All affected versions covered by Adobe advisory APSB26-63 are impacted, and successful exploitation grants full high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk is currently latent rather than active.
Denial of service in Wazuh's analysis engine (wazuh-analysisd) lets an unauthenticated remote attacker permanently halt SIEM alert processing on Wazuh manager versions 1.0.0 through 4.14.4. Because the official wazuh/wazuh-docker deployment ships with password-less agent enrollment enabled by default, an attacker can register as an agent and send a crafted rootcheck event that overflows a fixed 30-byte heap buffer, crashing the daemon while the dashboard and API keep showing stale data - silently blinding the SIEM. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Memory-disclosure via heap buffer overflow in libjxl (the JPEG XL reference codec) versions 0.11.2 and earlier lets an attacker who supplies a crafted APNG image trigger an out-of-bounds access in the DecodeImageAPNG function, leaking sensitive process memory. The upstream fix (PR #4804) adds a missing row-index bounds check before accessing frame rows. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and the issue is not listed in CISA KEV.
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in Microsoft Windows Terminal allows an unauthenticated attacker to run arbitrary code by tricking a user into interacting with malicious content that triggers an integer overflow (CWE-190). The flaw carries a CVSS 7.5 rating driven by high complexity and required user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Microsoft has released a patch through the MSRC update guide.
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger a one-byte over-read in the bundled libsyck lexer, with a total (per SSVC) technical impact of information disclosure or process crash. The flaw sits in newline_len/is_newline, which dereference the scan pointer (and the following byte for a "\r\n" pair) with no NUL-terminator or bounds check, so a block scalar sitting at a document boundary runs one byte past the heap lexer buffer. There is no public exploit identified at time of analysis and it is not in CISA KEV, but CPANSec-documented trigger inputs exist and it is explicitly an incomplete fix of CVE-2025-11683 on a lexer path the earlier patch missed.
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feeding a crafted YAML document to Load or LoadFile. The bundled libsyck base64 decoder (syck_base64dec) indexes its 256-entry b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table; because !!binary is a standard tag processed on the default Load path (not gated by $LoadBlessed or $LoadCode), the flaw is reachable without any opt-in. No CISA KEV listing and EPSS is low (0.19%, 8th percentile), so no public weaponized exploit is identified at time of analysis, though the exact trigger strings (e.g. '--- !!binary \x80\x80\x80\x80') are publicly documented in the vendor's CI test suite and the oss-security advisory.
Local privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write (CWE-787) reachable through a crafted IOCTL request to a privileged kernel-mode component, corrupting kernel memory. An authenticated local attacker on an engineering workstation running the software can leverage the corruption to escalate to SYSTEM/kernel privileges or crash the host. No public exploit identified at time of analysis; the flaw is documented in CISA ICS advisory ICSA-26-197-04 (reported by ICS-CERT) but is not listed in CISA KEV, and no EPSS score was supplied.
Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel memory by issuing a crafted IOCTL request to an out-of-bounds write flaw (CWE-787). Successful exploitation can elevate privileges to SYSTEM/kernel level or crash the host running this engineering workstation software for AutomationDirect Productivity-series PLCs. Reported through CISA ICS-CERT (ICSA-26-197-04); no public exploit identified at time of analysis and no KEV/EPSS signal is present.
Remote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet with malformed address parameters to trigger an out-of-bounds access during packet classification, potentially leading to remote code execution or a kernel panic. The flaw affects illumos-gate and downstream distributions (OmniOS, SmartOS/Triton) built before commit 53a3efde, and has existed since 2010 (commit a5407c02). There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is Unreported (E:U), but the attack requires no authentication or user interaction.
Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing process or disclose small amounts of adjacent process memory by feeding it a truncated or malformed XML document. The parserc_parse C routine performs multi-character lookahead (for tokens like '<![CDATA[' and element terminators) without verifying the offsets stay inside the input buffer, so inputs such as '<a/' read past the end. There is no public exploit identified at time of analysis and EPSS is low (0.19%), but SSVC rates the flaw automatable, reflecting how easily malformed XML can be delivered to any service that parses untrusted input with this module.
Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated or malformed HTML - such as the string "<a/" - force the C-based parserc_parse routine to read past the end of the input buffer. Because the parser performs multi-character lookahead for tokens like "<![CDATA" and element terminators ">" without bounds checks, adjacent heap memory can be disclosed or the process can crash. No public exploit was identified at time of analysis, but an upstream fix (GitHub PR #2) and per-version patches are available.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Out-of-bounds heap write in Tencent's ncnn neural-network inference framework allows a crafted .param model file to corrupt heap memory when parsed by Net::load_param(). Because ParamDict::load_param() and load_param_bin() validated the parsed parameter id only against the upper bound (id >= NCNN_MAX_PARAM_COUNT), a negative id indexes before the params[] array, giving an attacker a write primitive below the allocated buffer. No public exploit is identified at time of analysis and the issue is not in CISA KEV; an upstream source-code fix is available.
Denial of service in TDengine time-series database versions prior to 3.4.1.15 allows unauthenticated remote attackers to crash the server by sending a malformed compressed RPC packet. The transDecompressMsg() function trusts a compression-length field without verifying the packet is large enough to contain the 8-byte STransCompMsg header, leading to an out-of-bounds read, uncontrolled/underflowed allocation, and process crash. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; a vendor fix exists in 3.4.1.15.
Stack-based buffer overflow in TDengine (open-source IoT time-series database) versions 3.4.1.6 and earlier allows an authenticated user to trigger a one-byte out-of-bounds write by submitting SQL containing crafted escape sequences (\%, \_, or \x), leading to denial of service and potentially remote code execution. The flaw sits in the SQL parser's trimString() routine, which validates only a single byte of remaining space in the tmpTokenBuf stack buffer before writing escape-processed data. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in version 3.4.1.14.
Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.
Memory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an internal security review, are scored CVSS 9.8 and could let remote unauthenticated attackers trigger buffer-overflow conditions on Cisco video collaboration endpoints. Per the CVSS vector the flaw is network-reachable with no authentication or user interaction and yields total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed exploitation despite the critical score.
Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (DoS) and, on hosts with ASLR disabled or bypassed, potentially execute arbitrary code by sending crafted HTTP requests. The flaw is a data-plane-only issue triggered when a regex-based map directive references the map's regex capture variables before the map output variable in a string expression, or via a non-cacheable variable under certain conditions. F5 has released a patched version; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted archive on 7-Zip 26.01 and earlier; fixed in 7-Zip 26.02. Reported by Landon Peng of Lunbun LLC through the Zero Day Initiative, this flaw carries full confidentiality, integrity, and availability impact at the process level. A public POC is confirmed available via the Italian ACN portal, though EPSS sits at only 0.92% (57th percentile) and no CISA KEV listing exists, indicating targeted rather than widespread exploitation at time of analysis.
Heap-based buffer overflow in NTFS-3G through 2026.2.25 enables a local attacker to corrupt heap memory inside the SUID-root ntfs-3g binary by supplying a crafted NTFS image, with potential for privilege escalation to root. The flaw in build_inherited_id() (libntfs-3g/security.c) is triggered when a file is created inside a specially structured directory on the malicious volume. No public exploit identified at time of analysis; vendor patches are confirmed available for Ubuntu and SUSE.
Remote code execution or permanent denial of service in the Tenda AC10 v3 SOHO router (firmware V03.03.16.09) stems from a classic buffer overflow reachable through the /cgi-bin/UploadCfg web endpoint. Attackers who can reach the router's management interface can send oversized crafted input to crash the device permanently or potentially run arbitrary code on it. Proof-of-concept material appears to be published on GitHub, though this is not listed in CISA KEV and carries a low EPSS score of 0.17% (7th percentile), indicating no confirmed widespread exploitation yet.
Heap out-of-bounds read/write in OpenHTJ2K (High-Throughput JPEG 2000 reference codec) v0.18.4 and earlier lets an attacker corrupt heap memory by supplying a crafted J2K/JP2 codestream, with a confirmed heap information-leak primitive and vendor-claimed arbitrary code execution. The flaw is reached through every decoder entry point (invoke, invoke_line_based, invoke_line_based_stream, invoke_line_based_predecoded) and, notably, through a JPIP server's startup codestream load, making it network-reachable without user interaction. There is no public exploit identified at time of analysis, though the vendor changelog references non-public PoC files, and the issue is not listed in CISA KEV.
Arbitrary code execution in OpenHTJ2K (an open-source High Throughput JPEG 2000 codec by osamu620) versions 0.18.4 and earlier stems from an unchecked coding-pass counter overflowing the fixed pass_length[128] array while parsing crafted JPEG 2000 packet headers. An attacker who supplies a malicious J2K/HTJ2K image to an application built on the library can corrupt adjacent memory and potentially execute code. No public exploit identified at time of analysis; EPSS is low (0.20%) and CISA SSVC rates current exploitation as none, though technical impact is total and the flaw is automatable.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing and requires user interaction, so it is not remotely exploitable without victim action. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.