Buffer Overflow
Monthly
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function within the Synwit SWM341 board support package's CAN handler, allowing a local low-privileged attacker to corrupt the stack and potentially achieve code execution or crash the device. The flaw carries a CVSS 4.0 base score of 7.1, and publicly available exploit code exists. The vendor was contacted but did not respond, and there is no public evidence of active exploitation.
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within the ls1c CAN handler (bsp/loongson/ls1cdev/libraries/ls1c_can.h) for the Loongson LS1C board support package. A local attacker with low privileges can manipulate the recvmsg call path to overflow a stack buffer, corrupting memory to achieve code execution or crash the device. Publicly available exploit code exists (VulDB), but there is no public exploit identified as actively used in the wild; this is not on CISA KEV, and no vendor patch has been identified as the vendor did not respond to disclosure.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) image format parser lets an attacker achieve arbitrary code execution or crash the application when a victim opens a maliciously crafted PSP file. The flaw stems from incorrect buffer-size arithmetic on low bit-depth images, and affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; exploitation requires local file-open interaction (CVSS 7.3).
Out-of-bounds heap read in the Net::IP::LPM Perl module (all versions through 1.10) is triggered when an application passes an oversized CIDR prefix length (e.g. add("1.2.3.4/255") or a /255 IPv6 prefix) to the trie builder, which walks the packed address buffer by the attacker-supplied bit count without validating it against the 32-bit/128-bit address width. The read runs at most ~32 bytes past a 4- or 16-byte buffer and its contents are never returned through the module's API, so real-world impact is limited to a possible process abort under AddressSanitizer, valgrind, or a hardened allocator. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and SSVC lists exploitation status as none.
Remote denial of service in the IMS (IP Multimedia Subsystem) implementation of Unisoc mobile chipsets allows an unauthenticated remote attacker to crash the affected component via an out-of-bounds read triggered by a missing bounds check. The flaw spans a broad range of Unisoc SoCs (SC7731E, SC9832E, SC9863A, T310/T610/T618, T7200-series, T8100/T8200/T8300, T9100) commonly used in budget Android smartphones. It carries CVSS 7.5 with availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated command execution in WatchGuard Fireware OS lets a privileged administrator escalate a specially crafted CLI command into arbitrary code execution via an out-of-bounds write (CWE-787). The flaw affects a very broad version span (Fireware OS 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2), placing most currently and historically deployed WatchGuard Firebox appliances in scope. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 score of 8.6 reflects full confidentiality/integrity/availability impact once the required privileged access is obtained.
Remote code execution in WatchGuard Fireware OS (the operating system powering Firebox network security appliances) allows an authenticated privileged administrator to run arbitrary code on the firewall by sending specially crafted requests to the Management Web UI, which trigger an out-of-bounds write in the networkd process. The flaw spans a wide version range (11.8 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2) and carries a CVSS 4.0 base score of 8.6 (High). It was reported by WatchGuard's own PSIRT; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in WatchGuard Fireware OS (the firmware powering WatchGuard Firebox firewall appliances) allows an unauthenticated attacker positioned on the same local/adjacent network segment to trigger an out-of-bounds write and execute arbitrary code. The flaw spans a wide firmware range - 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2 - and was self-reported by WatchGuard via its PSIRT. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, unauthenticated, high-impact profile makes it a serious perimeter-device concern.
Authenticated arbitrary code execution in WatchGuard Fireware OS (12.1-12.12 and 2025.1-2026.2) arises from an out-of-bounds write in the wgagent process, reachable when a privileged user sends specially crafted requests to the Management Web UI. A high-privilege attacker (or one who has compromised admin credentials) can corrupt memory to run code on the firewall appliance, undermining the security gateway itself. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in WatchGuard Fireware OS (the firmware powering Firebox network security appliances) arises from an out-of-bounds write in the ikestubd process, reachable through the Management Web UI. An authenticated user holding privileged (administrative) access can send specially crafted requests to corrupt memory and execute code on the appliance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; risk is bounded by the requirement for existing privileged access.
Heap out-of-bounds writes in jxl-oxide's jxl-grid crate allow attacker-controlled memory corruption on 32-bit platforms when decoding a crafted JPEG XL image, potentially leading to arbitrary code execution. An integer overflow in AlignedGrid's width×height length calculation produces an undersized backing buffer for huge logical dimensions, after which rendering writes through mutable subgrids beyond the allocation. Publicly available exploit code exists in the advisory (miri/ASan PoC tests); no active exploitation is reported (not in CISA KEV) and no EPSS score was provided.
Denial of service in OpenVPN's HTTP proxy client allows a malicious or man-in-the-middle proxy server to trigger a one-byte stack buffer overrun by returning a crafted NTLMv2 authentication response, potentially crashing the client. This CVE-2026-11771 flaw was fixed in the coordinated OpenVPN 2.7.5 / 2.6.21 release of 1 July 2026 alongside several other memory-safety bugs; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (VA:H) with no confidentiality or integrity effect, and exploitation only applies to clients configured to route through an NTLMv2-authenticated HTTP proxy.
Buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" in GV-VMS and "WS Player" in VMS-Cloud) allows memory corruption and likely code execution in the local WebSocket server process. The `handle_connection_info` handler for the `connectionInfo` command copies attacker-controlled JSON strings (including the `ip` field) into fixed-size stack/heap buffers using unbounded byte-by-byte loops, so an oversized value overruns the buffer. Because the WebSocket server binds to localhost, exploitation is realistically driven by luring an authenticated user's browser to a malicious page that issues the command; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" for GV-VMS and "WS Player" for VMS-Cloud) lets an attacker corrupt fixed-size buffers and potentially achieve code execution against users of GV-VMS, GV-Cloud and related GeoVision products. The flaw lives in the local WebSocket server's connectionInfo command handler, which copies attacker-controlled JSON strings byte-by-byte without length checks; because a malicious web page loaded in the victim's browser can drive that local WebSocket, exploitation is scored network-reachable (CVSS 8.3) but requires user interaction and high attack complexity. No public exploit is identified at time of analysis, though the issue was reported by Cisco Talos, which typically develops proof-of-concept material.
Remote code execution in GeoVision GeoWebPlayer (the browser-facing 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related products) is possible because the local WebSocket server's connectionInfo handler copies attacker-controlled JSON fields into fixed-size buffers with unchecked byte-by-byte loops. A remote attacker who lures a user to a malicious web page can drive the victim's browser to send an oversized password field to the localhost WebSocket, overflowing the buffer and achieving code execution (CVSS 8.3). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-site WebSocket-driven buffer overflow in GeoVision GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) lets an attacker reach the localhost WebSocket server and overflow fixed-size buffers via the `connectionInfo` command's username field, achieving memory corruption and likely code execution (CVSS 8.3, CWE-120). Because the server listens on localhost, exploitation is reached through a victim's browser visiting a malicious page (UI:R, AC:H), giving high confidentiality, integrity and availability impact with a scope change. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw was independently documented by Cisco Talos (TALOS-2026-2375).
Buffer overflow vulnerabilities in GeoVision's GeoWebPlayer WebSocket addon (CWE-120) allow a remote attacker to induce code execution by luring a user running the addon into visiting a malicious webpage that sends a crafted `connectionInfo` WebSocket command with an oversized password field to the locally-listening service. The unbounded manual byte-by-byte copy in `handle_connection_info` overwrites adjacent memory, potentially yielding full process compromise across all impact dimensions (C:H/I:H/A:H). Reported by Cisco Talos (TALOS-2026-2375) and acknowledged by GeoVision; no public exploit code or CISA KEV listing identified at time of analysis.
Remote code execution in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) is possible because the addon's localhost WebSocket server processes a 'connectionInfo' command whose handler copies attacker-supplied JSON strings into fixed-size buffers without bounds checks (CWE-120). Because the WebSocket is reachable via the victim's browser (AV:N), a malicious web page can drive the overflow when a user with the addon installed visits it (UI:R), yielding memory corruption with high confidentiality, integrity and availability impact and a scope change. No public exploit identified at time of analysis, though Cisco Talos has published a detailed report (TALOS-2026-2375); no EPSS or CISA KEV data was provided.
Out-of-bounds read in ArduPilot's MAVLink ground-control-station handler (through Plane-4.6.3) lets a remote attacker on the MAVLink link send a crafted SERIAL_CONTROL message that reads memory beyond intended bounds in GCS_MAVLINK::handle_serial_control(), potentially disclosing adjacent flight-controller memory and/or crashing the autopilot. The CVSS 9.1 rating reflects high confidentiality and availability impact over an unauthenticated network vector, though EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis. An upstream fix is proposed via GitHub PR #32587 (issue #32524), but no tagged patched release is independently confirmed.
Out-of-bounds read in the libheif HEIF/HEIC decoding library affects applications that decode grid images carrying a 90 or 270 degree 'irot' rotation property. When a caller requests a tile by its displayed-grid coordinates, libheif validated those coordinates against the file's un-rotated grid dimensions instead of the rotation-swapped displayed dimensions, letting out-of-range coordinates through and producing an unsigned integer underflow in the inverse-rotation math. A crafted file can trigger a read outside the intended bounds, causing a crash (denial of service) and potential minor information disclosure; there is no public exploit identified at time of analysis.
Remote denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows an unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead/sub_444C8C function of its embedded web management service. The flaw impacts availability only - no code execution, data disclosure, or integrity loss is indicated - and CVSS rates it 7.5 (High). No public exploit identified at time of analysis, though a GitHub reverse-engineering report documents the vulnerable function; EPSS is low at 0.22% (13th percentile) and it is not on the CISA KEV list.
Denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets remote attackers crash the device by triggering a buffer overflow in the gohead web-management component's sub_487330 (FUN_00487330) function. The CVSS vector indicates unauthenticated network exploitation with availability-only impact, EPSS is low at 0.22% (13th percentile), and no active exploitation is recorded, though a public technical write-up of the flawed function exists on GitHub.
Denial of service in the UTT nv518G router (firmware nv518GV3v3.2.7-210919-161313) allows remote attackers to crash the device by sending crafted input to the gohead/sub_483ba0 web-management component, triggering a classic buffer overflow (CWE-120). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) indicates unauthenticated network reachability with availability-only impact, and publicly available exploit code exists via a GitHub write-up. There is no evidence of confidentiality or integrity impact, and EPSS remains low at 0.24%.
Out-of-bounds write in the V8 JavaScript engine of Google Chrome before 150.0.7871.46 lets a remote attacker achieve arbitrary code execution confined to the renderer sandbox when a victim loads a crafted HTML page. Google rates the Chromium severity as Low, and the aggregate CVSS is 8.8 because impact is total within the compromised process; however no public exploit has been identified at time of analysis and EPSS is only 0.24%. Exploitation requires user interaction (visiting a malicious page) and, on its own, does not escape the sandbox to the underlying OS.
Sandbox escape in Google Chrome's Tint WebGPU shader compiler affects all Desktop builds prior to 150.0.7871.46, where a crafted HTML page triggers an out-of-bounds write (CWE-787) that a remote attacker can leverage to break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, the flaw carries a CVSS 9.6 due to its scope-changing memory-corruption impact, but there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as none. A vendor patch is already available, so the practical priority is rapid browser updating rather than emergency mitigation.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.46) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. This is an out-of-bounds write (CWE-787) rated High by Chromium and scored CVSS 8.3. There is no public exploit identified at time of analysis and CISA SSVC lists exploitation as 'none', though the technical impact is rated 'total'.
Sandbox escape in Google Chrome for macOS (versions prior to 150.0.7871.46) stems from an out-of-bounds write in ANGLE, the graphics abstraction layer that translates WebGL/OpenGL ES calls to native backends (Metal on Mac). A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU/graphics process to potentially break out of the renderer sandbox. There is no public exploit identified at time of analysis; Google rated the Chromium severity as Medium, and CISA's SSVC framework marks exploitation as none, though the CVSS base score is 9.6 due to the scope-changing sandbox-escape impact.
Out-of-bounds read in the Dawn WebGPU implementation of Google Chrome before 150.0.7871.46 lets a remote attacker who lures a victim to a crafted HTML page potentially escape the renderer sandbox and disclose out-of-bounds memory. The upstream Chromium team rated the security severity as Low, yet the associated CVSS 3.1 base score is 9.6 due to a scope change and high triad impact. There is no public exploit identified at time of analysis, and the CISA SSVC decision framework records exploitation as none and automatable as no.
Out-of-bounds memory access in Google Chrome's Tint component (the WGSL shader translator inside the Dawn/WebGPU stack) affects all desktop builds prior to 150.0.7871.46 and lets a remote attacker corrupt memory when a victim opens a crafted HTML page. Chromium rates the severity High and the CVSS 3.1 score is 8.8, driven by high confidentiality, integrity, and availability impact requiring only that the user visit a malicious page. No public exploit identified at time of analysis, and the low EPSS score (0.19%, 9th percentile) indicates exploitation is not currently widespread.
Sandbox escape in Google Chrome's Dawn WebGPU implementation prior to 150.0.7871.46 lets a remote attacker use a crafted HTML page to trigger an out-of-bounds read and write, potentially breaking out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 (scope-changed), it requires the victim to visit a malicious page but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's Skia graphics library (versions before 150.0.7871.46) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated Medium by Chromium but scored CVSS 8.3 due to scope change and total impact; there is no public exploit identified at time of analysis and SSVC reports no observed exploitation. Realistically it is a second-stage bug that must be chained with a prior renderer compromise, which raises the practical difficulty.
Sandbox escape in Google Chrome's Skia graphics library affects all desktop builds prior to 150.0.7871.46, where an integer overflow triggered by a crafted HTML page can break out of the renderer sandbox into the more-privileged browser process. A remote attacker who lures a victim to a malicious page could potentially compromise the host beyond the rendering sandbox. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none'.
Heap corruption in the V8 JavaScript engine of Google Chrome before 150.0.7871.46 lets a remote attacker who lures a user to a crafted HTML page and coaxes them into specific UI gestures potentially achieve memory corruption and code execution in the renderer. The flaw was reported internally by the Chrome team and is patched in the Stable channel; no public exploit identified at time of analysis, and EPSS is low (0.18%, 8th percentile). Note the tension in the signals: NVD/aggregator CVSS is 8.8 (High) while Google's own Chromium severity rating is Low.
Arbitrary code execution within the renderer sandbox affects Google Chrome desktop versions prior to 150.0.7871.46, where an inappropriate implementation flaw in the V8 JavaScript engine lets a remote attacker run code confined to the browser sandbox after a victim opens a crafted HTML page. Google rated the Chromium severity as Medium, and the code execution is explicitly described as occurring inside the sandbox rather than as a full sandbox escape. There is no public exploit identified at time of analysis and the vulnerability is not on CISA KEV, with a low EPSS score of 0.28% (20th percentile).
Sandbox escape in Google Chrome desktop before 150.0.7871.46 is possible through a heap buffer overflow in the Skia graphics library, letting an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a second-stage bug: it presumes prior renderer code execution rather than granting initial access on its own. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none.
Out-of-bounds memory access in Google Chrome's ANGLE graphics component on macOS lets a remote attacker corrupt heap memory when a victim opens a crafted HTML page in versions before 150.0.7871.46. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication; there is no public exploit identified at time of analysis and it is not on CISA KEV, with a low EPSS of 0.21% (11th percentile). A vendor patch is available.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets a remote attacker crash the device by sending crafted input to the gohead/sub_448384 (FUN_00448384) handler, triggering a stack-based buffer overflow. The CVSS 3.1 vector marks it network-reachable and unauthenticated with high availability impact but no confidentiality or integrity effect. Publicly available exploit code exists via a GitHub CVE report; there is no CISA KEV listing and no EPSS score in the provided data.
Denial of service in ClamAV's DMG file format parser allows a remote, unauthenticated attacker to crash the scanning engine by submitting a crafted Apple Disk Image (DMG) for inspection. The flaw stems from an integer overflow triggered during boundary checks on DMG content and manifests only on 32-bit builds of ClamAV; memory corruption raises the theoretical possibility of expanded impact beyond a crash, though only DoS is described. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in ClamAV's ALZ archive parser allows an unauthenticated, remote attacker to crash the scanning engine by submitting a crafted ALZ file, with the vendor noting possible expanded impact beyond DoS. The flaw is a heap out-of-bounds write triggered during scanning, and because ClamAV is commonly deployed as an automated mail/upload gateway scanner, an attacker only needs to get a malicious file scanned. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Availability-impacting out-of-bounds write in ClamAV's PESpin file-format parser lets an unauthenticated remote attacker crash the scanning engine by submitting a crafted PESpin-packed file for scanning. Because ClamAV frequently sits inline on mail gateways, file-upload paths, and proxies, a single malicious sample can terminate the scanning process and produce a denial of service; the memory corruption may permit expanded impact beyond DoS though only crash impact is confirmed. There is no public exploit identified at time of analysis and it is not on CISA KEV, with EPSS not provided.
Denial of service in ClamAV's 7z archive scanner allows a remote, unauthenticated attacker to crash the scanning process by submitting a crafted 7z file, resulting in an out-of-bounds heap write (CWE-120). Because ClamAV is commonly deployed inline on mail gateways and upload-scanning pipelines, a single malicious attachment can be delivered without any interaction or credentials. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, though Cisco (ClamAV's maintainer) rates confidentiality/integrity impact as none and availability as high.
Denial of service in ClamAV's FSG file format parser allows an unauthenticated remote attacker to crash the scanning engine, and potentially achieve broader memory-corruption impact, by submitting a crafted FSG-compressed portable executable to be scanned. The flaw stems from an out-of-bounds buffer write during FSG decompression, affecting any deployment that scans attacker-supplied files. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network-reachable, no-authentication, no-interaction nature (CVSS 7.5) makes it a meaningful availability risk for mail/file-scanning gateways.
Denial of service in ClamAV's PE (Portable Executable) file format parser lets an unauthenticated, remote attacker crash the scanning engine by submitting a crafted PE file for scanning, triggering an out-of-bounds buffer write (CWE-120). Reported by Cisco PSIRT (ClamAV's maintainer), the flaw carries CVSS 7.5 with an availability-only impact; the advisory notes memory corruption could 'possibly' enable expanded impacts beyond DoS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) returned in fno.fname are copied by downstream callers into short fixed-size buffers without bounds checks, corrupting memory in the embedded application. Reported by runZero, this is a downstream-caller (CWE-120) pattern affecting integrations of the popular ChaN FatFs embedded filesystem library rather than a defect in FatFs core parsing itself. Publicly available exploit code exists (SSVC Exploitation: PoC, runZero GitHub repo) with total technical impact, though the physical attack vector (AV:P) meaningfully constrains real-world reach; no CISA KEV listing.
Stack-based buffer overflow in FatFs R0.16 and earlier allows an attacker who can present crafted exFAT media to corrupt the stack via f_getlabel(), because the exFAT volume-label length field (XDIR_NumLabel) is trusted without enforcing the specification maximum. FatFs is an embedded FAT/exFAT filesystem library used across microcontroller and IoT firmware, so any device that mounts and reads the label of attacker-supplied storage is exposed. Publicly available exploit code exists (runZero advisory and SSVC 'PoC'), but there is no public exploit identified in active use and it is not listed in CISA KEV.
Integer overflow in ELM-Chan FatFS R0.16 and earlier lets a crafted FAT32 volume corrupt file-size metadata during mount_volume(), where `fasize *= fs->n_fats` wraps and produces attacker-controlled, oversized read lengths in downstream callers. The affected code is a widely embedded FAT filesystem library used across microcontrollers and IoT firmware, and while primarily triggered by mounting malicious media, the vendor notes remote delivery is feasible via OTA/update pipelines. Publicly available exploit code exists (runZero research and proof-of-concept repository); no public exploit identified as actively used and it is not listed in CISA KEV.
Boot-time denial of service affects Rust-enabled Linux kernels on arm64 when both CONFIG_UNWIND_TABLES and CONFIG_UNWIND_PATCH_PAC_INTO_SCS are set and the kernel is built with rustc older than 1.98.0. A rustc bug omits the module-level uwtable annotation, so compiler-generated constructors (e.g. KASAN's asan.module_ctor) carry incorrect DWARF unwind data; the shadow-call-stack (SCS) boot patcher then rewrites the paciasp but not the matching autiasp instruction, corrupting the constructor and triggering a KASAN global-out-of-bounds fault and kernel panic during do_ctors() at boot. This is a self-inflicted toolchain/config interaction rather than an attacker-driven flaw - no public exploit identified at time of analysis, not in CISA KEV, and EPSS is only 0.16% (5th percentile).
Out-of-bounds read in the Linux kernel's AMD Display (amdgpu DRM) DisplayPort code allows a local attacker - or a malicious/attacker-controlled DisplayPort sink - to trigger a one-element over-read of the aux_rd_interval[] array in dp_get_eq_aux_rd_interval(). The array in struct dc_lttpr_caps holds only MAX_REPEATER_CNT-1 (7) entries but is indexed with an offset up to MAX_REPEATER_CNT (8) when a sink advertises 8 LTTPR repeaters via DPCD, reading aux_rd_interval[7]. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%, 6th percentile), and the vendor has released fixed kernel versions.
Heap overflow in the Linux kernel's AMD GPU display driver (drm/amd/display) arises because dal_vector_reserve() computes its allocation size as "capacity * struct_size" in 32-bit arithmetic, which can silently wrap to a small value and cause krealloc() to return an undersized buffer. A local, low-privileged user with access to the DRM/amdgpu device can trigger out-of-bounds heap writes on subsequent vector appends, potentially corrupting kernel memory. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile); the issue is fixed and rated CVSS 7.0 (High).
Remote code execution in the UltraVNC repeater (through version 1.8.2.2) allows an unauthenticated attacker who can reach the built-in HTTP administration port (default TCP 80) to overflow a fixed 1000-byte global buffer and corrupt adjacent .bss globals, leading to arbitrary code execution on the host. The flaw lives in wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c, where the request URI is copied via unchecked sprintf before any authentication check runs. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 combined with pre-auth network reachability makes this a high-priority issue.
Remote code execution in the UltraVNC Viewer (all versions through 1.8.2.2) stems from an integer overflow in the RFB failure-response parser: a malicious or man-in-the-middle VNC server can send a reasonLen of 0xFFFFFFFF that wraps to 0 during buffer sizing, then stream 4 GiB into a 256-byte heap allocation. The flaw is reachable pre-authentication through connection-failure and auth-failure messages, so merely connecting a viewer to an attacker-controlled endpoint can corrupt the heap and potentially execute code as the user running the viewer. No public exploit identified at time of analysis, though the researcher confirmed a reliable heap-buffer-overflow write with AddressSanitizer.
Denial of service in the UltraVNC viewer (vncviewer) through 1.8.2.2 arises from an off-by-one stack buffer overflow in the RFB ServerInit message handler, where a malicious VNC server advertising a desktop name of exactly 2024 bytes forces ReadString to write a NUL terminator at _dn[2024], one byte past a 2024-byte stack buffer. A rogue or compromised server can crash victims who connect to it (reliable process termination on /GS-hardened builds) and potentially corrupt adjacent stack data on canary-less release builds. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation requires the victim to initiate a connection to the attacker-controlled server.
Remote code execution in the UltraVNC Repeater (through version 1.8.2.2) allows an authenticated administrator to corrupt stack memory via the web GUI allow/deny rule parser, ultimately achieving code execution on the repeater host. The flaw (CWE-787, out-of-bounds write) is reachable only after admin login, but that barrier is significantly weakened when chained with CVE-2026-7839 (default password), which can hand an attacker the required credentials. There is no public exploit identified at time of analysis and no EPSS/KEV data supplied, so this is currently a credentialed, chainable RCE rather than a confirmed mass-exploited threat.
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a rogue base station to corrupt modem memory via a missing bounds check (out-of-bounds write, CWE-787). Once a target UE camps on the attacker-controlled cell, exploitation requires no user interaction and no pre-existing privileges, potentially yielding privilege escalation within the modem subsystem. Tracked in MediaTek's July 2026 Product Security Bulletin (Patch ID MOLY01402160); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in the RAR5 recovery-volume (.rev) parser of WinRAR, RAR, UnRAR, and unrar.dll (versions before 7.23) lets an attacker corrupt heap memory when a victim runs a recovery, test, or repair operation on a crafted multi-file .rev set. Because subsequent .rev files supply a RecNum value validated only against their own TotalCount and never against the actual RecItems allocation, an attacker-controlled 32-bit value can be written far past the buffer, enabling memory corruption and potential code execution. There is no public exploit identified at time of analysis, but this is the RAR5-path sibling of the previously exploited CVE-2023-40477, and CWE-787 flaws in WinRAR have historically led to reliable RCE.
Heap-based buffer overflow in libde265, the open-source H.265/HEVC video codec library by strukturag, allows remote unauthenticated attackers to trigger memory disclosure and denial-of-service by supplying a specially crafted HEVC-encoded input. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) indicates network-reachable exploitation requiring high complexity but no authentication or user interaction, consistent with server-side media processing pipelines. No public exploit code and no CISA KEV listing are confirmed at time of analysis. Ubuntu has issued USN-8573-1 and a vendor patch is available via the strukturag GitHub advisory GHSA-j2qq-x2xq-g9wr.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash the device by triggering a buffer overflow in the gohead/sub_425994 (FUN_00425994) web-server routine. Publicly available exploit/PoC documentation exists (GitHub CVEreport), and the SSVC framework rates exploitation as PoC-stage and automatable, though EPSS remains low at 0.22% (13th percentile) with no confirmed active exploitation.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash the device by triggering a buffer overflow in the gohead/sub_447CAC web-server routine. Publicly available exploit code exists (referenced GitHub CVEreport analysis) but it is not listed in CISA KEV; EPSS is low at 0.22% (13th percentile), indicating no observed widespread exploitation. Note a data conflict: the description and tags describe a DoS, yet the supplied CVSS vector encodes a confidentiality impact (C:H/A:N) rather than availability.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the renderer sandbox via a crafted HTML page. The flaw is a CWE-787 out-of-bounds read and write; Google's own Chromium team rated the security severity as Low, and there is no public exploit identified at time of analysis. EPSS estimates only a 0.17% (7th percentile) chance of exploitation, and the vulnerability is not listed in CISA KEV.
Out-of-bounds memory read in the CameraCapture component of Google Chrome on ChromeOS (versions prior to 150.0.7871.47) lets a remote attacker leak adjacent process memory when a victim opens a crafted HTML page. No public exploit identified at time of analysis, and EPSS is low (0.17%), but the flaw is marked automatable by CISA SSVC. Note a signal conflict: the NVD CVSS is 8.1 (high) while Google rates the Chromium security severity as Low.
Heap corruption in Google Chrome's WebNN (Web Neural Network API) implementation on Windows, fixed in 150.0.7871.47, lets an attacker who has already compromised the renderer process trigger a heap buffer overflow via a crafted HTML page and potentially escalate beyond the sandbox. Chromium's own security team rated this Low severity, while NVD scores it 8.8; EPSS is low at 0.19% (9th percentile) and there is no public exploit identified at time of analysis. It is not listed in CISA KEV and SSVC records exploitation status as none.
Out-of-bounds memory read in the SurfaceCapture component of Google Chrome before 150.0.7871.47 lets a remote attacker leak adjacent heap memory when a victim opens a crafted HTML page. Chromium rated the flaw Medium severity, though the associated CVSS is 8.1; there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.17% (7th percentile), consistent with a browser bug fixed pre-disclosure. Successful exploitation could disclose sensitive in-process data or crash the renderer, and typically serves as one link in a larger sandbox-escape chain rather than standalone compromise.
Navigation restriction bypass in Google Chrome on macOS prior to 150.0.7871.47 lets a remote attacker evade Safe Browsing protections by luring a victim into opening a malicious file, via an integer overflow in the Safe Browsing component. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The practical effect is that a security warning meant to block dangerous navigations can be defeated, not direct code execution.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no authentication, and the flaw carries a CVSS 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), indicating no evidence of widespread exploitation despite the high CVSS.
Out-of-bounds memory write in Google Chrome's Fonts component (versions prior to 150.0.7871.47) lets a remote attacker corrupt heap memory when a victim renders a crafted HTML page, creating a path toward renderer-process code execution. The flaw stems from an integer overflow during font handling and requires only that the target open an attacker-controlled page. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Heap-based integer overflow in Google Chrome's Chromecast component allows an adjacent-network attacker to achieve arbitrary code execution against browsers running versions prior to 150.0.7871.47. The flaw is reachable via crafted malicious network traffic and carries a high CVSS of 8.8; Google has shipped a stable-channel fix, and no public exploit has been identified at time of analysis. Chromium rates the underlying issue as Medium severity despite the high CVSS, reflecting the adjacency and interaction constraints.
Sandbox escape in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the sandbox and execute code in the more privileged browser context via a crafted HTML page. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and SSVC records exploitation status as none.
Heap corruption in Google Chrome's XML implementation on all desktop platforms prior to 150.0.7871.47 allows a remote attacker to potentially achieve code execution when a victim visits a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8 (network vector, user interaction required), this is a memory-safety flaw (CWE-122 heap-based buffer overflow) reported through Google's internal CVE process. There is no public exploit identified at time of analysis, and SSVC assessment shows exploitation status of none with a low EPSS of 0.21%.
Out-of-bounds read/write (use-after-free) in Google Chrome's GPU component lets a remote attacker who has already compromised the renderer process run arbitrary code - though still confined inside the sandbox - by serving a crafted HTML page to a Chrome build prior to 150.0.7871.47. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and EPSS puts near-term exploitation probability at just 0.26%.
Out-of-bounds memory read in the ANGLE graphics component of Google Chrome on macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process read memory outside intended bounds via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it functions as a chained post-exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Affects Chrome desktop versions prior to 150.0.7871.47, rated High by Chromium with a CVSS of 8.3. There is no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records exploitation as none.
Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 stems from a heap buffer overflow in the Chromecast component, letting an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, but it is a second-stage bug requiring prior renderer control, and there is no public exploit identified at time of analysis (SSVC exploitation: none, EPSS 0.22%). No CISA KEV listing exists, indicating no confirmed active exploitation.
Sandbox escape in Google Chrome's Chromecast component before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to the more privileged browser process. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change; however, EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.
Denial of service in the msgpack-python serialization library (versions prior to 1.2.1) lets remote attackers crash a process via an out-of-bounds read when an application reuses an Unpacker instance after a previously raised error was caught. Sending malformed MessagePack data that triggers an error, then feeding further data to the same Unpacker, can drive the process to a SEGV. No public exploit has been identified at time of analysis, and EPSS data was not provided, but the CVSS 3.1 score of 7.5 (availability-only) reflects a straightforward, unauthenticated crash condition.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets a remote, unauthenticated attacker crash the device by triggering a buffer overflow in the gohead web-service function sub_416f28 (FUN_00416f28). Publicly available exploit code exists (referenced PoC on GitHub), though the flaw is not listed in CISA KEV and EPSS scores it at just 0.22% (13th percentile), indicating low observed exploitation activity. Impact is limited to availability - no code execution or data exposure is claimed in the source data.
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.
Memory-corruption weaknesses in Mozilla Firefox 152.0.3 could allow remote attackers to potentially execute arbitrary code within the browser process. Mozilla graded the collected memory-safety bugs as critical (MFSA2026-62) and states some showed evidence of memory corruption that, with sufficient effort, could be exploited for code execution; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). The issue is resolved in Firefox 152.0.4.
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that produce unpredictable or erroneous behavior when the appliance is configured for specific DNS or load-balancing roles. Remote unauthenticated attackers can send crafted traffic to a vulnerable appliance to crash or destabilize it, with the CVSS 4.0 score of 8.8 driven primarily by high availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated attackers to trigger unpredictable or erroneous appliance behavior when the device is deployed as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication, and the high confidentiality impact suggests memory contents may be exposed alongside the DoS condition. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the appliance is configured as a SAML identity provider (IDP), enabling disclosure of sensitive in-memory data such as tokens, session material, or other process memory. The CVSS 4.0 score of 8.8 reflects network-reachable, unauthenticated exploitation (PR:N) with high confidentiality and availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The flaw belongs to the same class of NetScaler appliance vulnerabilities (e.g., Citrix Bleed-style memory disclosure) that have historically drawn aggressive exploitation, making prompt patching advisable.
Denial of service in hostapd 2.11 through pre-2.12 development snapshots (built with CONFIG_IEEE80211BE) lets an unauthenticated attacker within wireless range crash the access-point daemon by sending a crafted Wi-Fi 7 (802.11be) Multi-Link association request. A malformed Multi-Link Element or Per-STA Profile subelement supplies a link_id of 15 that overruns the 15-entry (0-14) links[] array, causing an out-of-bounds write before the 4-way handshake. No public exploit identified at time of analysis; EPSS is low (0.29%, 20th percentile) and CISA SSVC rates exploitation as none.
Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-Bus introspection XML that nests a <node> element inside <method>, <signal>, <property>, or <arg>. This state-confusion bug triggers an unsigned integer underflow/overflow (CWE-191) and a subsequent out-of-bounds read, crashing any application or service that parses attacker-influenced introspection data. No public exploit identified at time of analysis, EPSS is low (0.34%), and CISA SSVC rates exploitation as none with only partial technical impact.
Buffer over-read in GLib's giochannel line-reading code (g_io_channel_read_line_backend) affects the GNOME GLib library prior to version 2.88.1, where an application that configures a multi-byte custom line terminator triggers memcmp to read past the end of the internal GString buffer. Depending on memory layout, this leaks up to 7 bytes of adjacent heap memory (minor information disclosure) or crashes the process when the over-read crosses an unmapped page boundary (denial of service). There is no public exploit identified at time of analysis, EPSS is low (0.27%), and CISA SSVC rates exploitation as none.
Buffer over-read in GNOME GLib's g_regex_replace() lets remote attackers leak 1-5 adjacent bytes of process memory and crash applications when regex replacement is performed with the G_REGEX_RAW compile flag combined with case-change replacement escapes. The internal string_append helper applies UTF-8 aware routines to matched substrings even though G_REGEX_RAW treats the buffer as raw bytes, reading past the intended boundary. There is no public exploit identified at time of analysis and EPSS is low (0.26%, 18th percentile), but the flaw is broadly reachable because GLib underpins the GNOME stack and ships across Red Hat Enterprise Linux 6-10.
Out-of-bounds read of two bytes in GLib's g_date_time_get_ymd() (glib/gdatetime.c) lets attackers corrupt date output and trigger logic errors that may cause denial of service when an application processes an invalid GDateTime produced by g_date_time_add_full(). It affects the GNOME GLib core utility library shipped across Red Hat Enterprise Linux 6 through 10, with fixes in GLib 2.88.1 and 2.86.5. There is publicly available exploit code exists per SSVC (proof-of-concept), no confirmed active exploitation, and EPSS is low at 0.27% (19th percentile).
Out-of-bounds read in GNOME GLib's GVariant serialiser allows remote attackers to leak a single byte of adjacent memory and to crash applications that deserialise untrusted GVariant data. The flaw sits in gvs_tuple_is_normal() in glib/gvariant-serialiser.c, where an alignment-padding bounds check uses '>' instead of '>=', reading one byte past the buffer; when that byte falls across a page boundary the process faults, producing a denial of service. No public exploit identified at time of analysis, and EPSS is low (0.26%), but GLib's near-universal presence on Linux systems makes the exposure broad.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3 v3.2.7-210919-161313) allows a remote, unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead web-service handler at function sub_472f08 (FUN_00472f08). The CVSS 3.1 score of 7.5 reflects availability-only impact (A:H, C:N/I:N) over the network with no privileges or user interaction. EPSS is low (0.22%, 13th percentile) and the CVE is not in CISA KEV; a third-party technical write-up exists on GitHub, but no active exploitation is confirmed.
Memory corruption via use-after-free in Apple's WebKit browser engine allows remote attackers to corrupt memory when a victim processes maliciously crafted web content on Safari, iOS/iPadOS, or macOS prior to 26.5.2. The CVSS 3.1 score of 8.8 reflects network-reachable exploitation requiring only that a user open a malicious page; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV. Successful exploitation typically serves as the initial stage of a browser-based attack chain (often paired with a sandbox escape) to achieve code execution in the renderer.
Memory corruption via type confusion in Apple's WebKit browser engine allows attackers to corrupt memory by luring a victim to maliciously crafted web content, affecting Safari, iOS/iPadOS, and macOS before version 26.5.2. The flaw (CWE-843) is network-reachable but requires user interaction (visiting a page), and no public exploit has been identified at time of analysis. Apple has shipped patches across Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2.
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function within the Synwit SWM341 board support package's CAN handler, allowing a local low-privileged attacker to corrupt the stack and potentially achieve code execution or crash the device. The flaw carries a CVSS 4.0 base score of 7.1, and publicly available exploit code exists. The vendor was contacted but did not respond, and there is no public evidence of active exploitation.
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within the ls1c CAN handler (bsp/loongson/ls1cdev/libraries/ls1c_can.h) for the Loongson LS1C board support package. A local attacker with low privileges can manipulate the recvmsg call path to overflow a stack buffer, corrupting memory to achieve code execution or crash the device. Publicly available exploit code exists (VulDB), but there is no public exploit identified as actively used in the wild; this is not on CISA KEV, and no vendor patch has been identified as the vendor did not respond to disclosure.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) image format parser lets an attacker achieve arbitrary code execution or crash the application when a victim opens a maliciously crafted PSP file. The flaw stems from incorrect buffer-size arithmetic on low bit-depth images, and affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; exploitation requires local file-open interaction (CVSS 7.3).
Out-of-bounds heap read in the Net::IP::LPM Perl module (all versions through 1.10) is triggered when an application passes an oversized CIDR prefix length (e.g. add("1.2.3.4/255") or a /255 IPv6 prefix) to the trie builder, which walks the packed address buffer by the attacker-supplied bit count without validating it against the 32-bit/128-bit address width. The read runs at most ~32 bytes past a 4- or 16-byte buffer and its contents are never returned through the module's API, so real-world impact is limited to a possible process abort under AddressSanitizer, valgrind, or a hardened allocator. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and SSVC lists exploitation status as none.
Remote denial of service in the IMS (IP Multimedia Subsystem) implementation of Unisoc mobile chipsets allows an unauthenticated remote attacker to crash the affected component via an out-of-bounds read triggered by a missing bounds check. The flaw spans a broad range of Unisoc SoCs (SC7731E, SC9832E, SC9863A, T310/T610/T618, T7200-series, T8100/T8200/T8300, T9100) commonly used in budget Android smartphones. It carries CVSS 7.5 with availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated command execution in WatchGuard Fireware OS lets a privileged administrator escalate a specially crafted CLI command into arbitrary code execution via an out-of-bounds write (CWE-787). The flaw affects a very broad version span (Fireware OS 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2), placing most currently and historically deployed WatchGuard Firebox appliances in scope. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 score of 8.6 reflects full confidentiality/integrity/availability impact once the required privileged access is obtained.
Remote code execution in WatchGuard Fireware OS (the operating system powering Firebox network security appliances) allows an authenticated privileged administrator to run arbitrary code on the firewall by sending specially crafted requests to the Management Web UI, which trigger an out-of-bounds write in the networkd process. The flaw spans a wide version range (11.8 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2) and carries a CVSS 4.0 base score of 8.6 (High). It was reported by WatchGuard's own PSIRT; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in WatchGuard Fireware OS (the firmware powering WatchGuard Firebox firewall appliances) allows an unauthenticated attacker positioned on the same local/adjacent network segment to trigger an out-of-bounds write and execute arbitrary code. The flaw spans a wide firmware range - 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2 - and was self-reported by WatchGuard via its PSIRT. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, unauthenticated, high-impact profile makes it a serious perimeter-device concern.
Authenticated arbitrary code execution in WatchGuard Fireware OS (12.1-12.12 and 2025.1-2026.2) arises from an out-of-bounds write in the wgagent process, reachable when a privileged user sends specially crafted requests to the Management Web UI. A high-privilege attacker (or one who has compromised admin credentials) can corrupt memory to run code on the firewall appliance, undermining the security gateway itself. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in WatchGuard Fireware OS (the firmware powering Firebox network security appliances) arises from an out-of-bounds write in the ikestubd process, reachable through the Management Web UI. An authenticated user holding privileged (administrative) access can send specially crafted requests to corrupt memory and execute code on the appliance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; risk is bounded by the requirement for existing privileged access.
Heap out-of-bounds writes in jxl-oxide's jxl-grid crate allow attacker-controlled memory corruption on 32-bit platforms when decoding a crafted JPEG XL image, potentially leading to arbitrary code execution. An integer overflow in AlignedGrid's width×height length calculation produces an undersized backing buffer for huge logical dimensions, after which rendering writes through mutable subgrids beyond the allocation. Publicly available exploit code exists in the advisory (miri/ASan PoC tests); no active exploitation is reported (not in CISA KEV) and no EPSS score was provided.
Denial of service in OpenVPN's HTTP proxy client allows a malicious or man-in-the-middle proxy server to trigger a one-byte stack buffer overrun by returning a crafted NTLMv2 authentication response, potentially crashing the client. This CVE-2026-11771 flaw was fixed in the coordinated OpenVPN 2.7.5 / 2.6.21 release of 1 July 2026 alongside several other memory-safety bugs; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (VA:H) with no confidentiality or integrity effect, and exploitation only applies to clients configured to route through an NTLMv2-authenticated HTTP proxy.
Buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" in GV-VMS and "WS Player" in VMS-Cloud) allows memory corruption and likely code execution in the local WebSocket server process. The `handle_connection_info` handler for the `connectionInfo` command copies attacker-controlled JSON strings (including the `ip` field) into fixed-size stack/heap buffers using unbounded byte-by-byte loops, so an oversized value overruns the buffer. Because the WebSocket server binds to localhost, exploitation is realistically driven by luring an authenticated user's browser to a malicious page that issues the command; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" for GV-VMS and "WS Player" for VMS-Cloud) lets an attacker corrupt fixed-size buffers and potentially achieve code execution against users of GV-VMS, GV-Cloud and related GeoVision products. The flaw lives in the local WebSocket server's connectionInfo command handler, which copies attacker-controlled JSON strings byte-by-byte without length checks; because a malicious web page loaded in the victim's browser can drive that local WebSocket, exploitation is scored network-reachable (CVSS 8.3) but requires user interaction and high attack complexity. No public exploit is identified at time of analysis, though the issue was reported by Cisco Talos, which typically develops proof-of-concept material.
Remote code execution in GeoVision GeoWebPlayer (the browser-facing 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related products) is possible because the local WebSocket server's connectionInfo handler copies attacker-controlled JSON fields into fixed-size buffers with unchecked byte-by-byte loops. A remote attacker who lures a user to a malicious web page can drive the victim's browser to send an oversized password field to the localhost WebSocket, overflowing the buffer and achieving code execution (CVSS 8.3). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-site WebSocket-driven buffer overflow in GeoVision GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) lets an attacker reach the localhost WebSocket server and overflow fixed-size buffers via the `connectionInfo` command's username field, achieving memory corruption and likely code execution (CVSS 8.3, CWE-120). Because the server listens on localhost, exploitation is reached through a victim's browser visiting a malicious page (UI:R, AC:H), giving high confidentiality, integrity and availability impact with a scope change. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw was independently documented by Cisco Talos (TALOS-2026-2375).
Buffer overflow vulnerabilities in GeoVision's GeoWebPlayer WebSocket addon (CWE-120) allow a remote attacker to induce code execution by luring a user running the addon into visiting a malicious webpage that sends a crafted `connectionInfo` WebSocket command with an oversized password field to the locally-listening service. The unbounded manual byte-by-byte copy in `handle_connection_info` overwrites adjacent memory, potentially yielding full process compromise across all impact dimensions (C:H/I:H/A:H). Reported by Cisco Talos (TALOS-2026-2375) and acknowledged by GeoVision; no public exploit code or CISA KEV listing identified at time of analysis.
Remote code execution in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and VMS-Cloud) is possible because the addon's localhost WebSocket server processes a 'connectionInfo' command whose handler copies attacker-supplied JSON strings into fixed-size buffers without bounds checks (CWE-120). Because the WebSocket is reachable via the victim's browser (AV:N), a malicious web page can drive the overflow when a user with the addon installed visits it (UI:R), yielding memory corruption with high confidentiality, integrity and availability impact and a scope change. No public exploit identified at time of analysis, though Cisco Talos has published a detailed report (TALOS-2026-2375); no EPSS or CISA KEV data was provided.
Out-of-bounds read in ArduPilot's MAVLink ground-control-station handler (through Plane-4.6.3) lets a remote attacker on the MAVLink link send a crafted SERIAL_CONTROL message that reads memory beyond intended bounds in GCS_MAVLINK::handle_serial_control(), potentially disclosing adjacent flight-controller memory and/or crashing the autopilot. The CVSS 9.1 rating reflects high confidentiality and availability impact over an unauthenticated network vector, though EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis. An upstream fix is proposed via GitHub PR #32587 (issue #32524), but no tagged patched release is independently confirmed.
Out-of-bounds read in the libheif HEIF/HEIC decoding library affects applications that decode grid images carrying a 90 or 270 degree 'irot' rotation property. When a caller requests a tile by its displayed-grid coordinates, libheif validated those coordinates against the file's un-rotated grid dimensions instead of the rotation-swapped displayed dimensions, letting out-of-range coordinates through and producing an unsigned integer underflow in the inverse-rotation math. A crafted file can trigger a read outside the intended bounds, causing a crash (denial of service) and potential minor information disclosure; there is no public exploit identified at time of analysis.
Remote denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows an unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead/sub_444C8C function of its embedded web management service. The flaw impacts availability only - no code execution, data disclosure, or integrity loss is indicated - and CVSS rates it 7.5 (High). No public exploit identified at time of analysis, though a GitHub reverse-engineering report documents the vulnerable function; EPSS is low at 0.22% (13th percentile) and it is not on the CISA KEV list.
Denial of service in the UTT nv518G security gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets remote attackers crash the device by triggering a buffer overflow in the gohead web-management component's sub_487330 (FUN_00487330) function. The CVSS vector indicates unauthenticated network exploitation with availability-only impact, EPSS is low at 0.22% (13th percentile), and no active exploitation is recorded, though a public technical write-up of the flawed function exists on GitHub.
Denial of service in the UTT nv518G router (firmware nv518GV3v3.2.7-210919-161313) allows remote attackers to crash the device by sending crafted input to the gohead/sub_483ba0 web-management component, triggering a classic buffer overflow (CWE-120). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) indicates unauthenticated network reachability with availability-only impact, and publicly available exploit code exists via a GitHub write-up. There is no evidence of confidentiality or integrity impact, and EPSS remains low at 0.24%.
Out-of-bounds write in the V8 JavaScript engine of Google Chrome before 150.0.7871.46 lets a remote attacker achieve arbitrary code execution confined to the renderer sandbox when a victim loads a crafted HTML page. Google rates the Chromium severity as Low, and the aggregate CVSS is 8.8 because impact is total within the compromised process; however no public exploit has been identified at time of analysis and EPSS is only 0.24%. Exploitation requires user interaction (visiting a malicious page) and, on its own, does not escape the sandbox to the underlying OS.
Sandbox escape in Google Chrome's Tint WebGPU shader compiler affects all Desktop builds prior to 150.0.7871.46, where a crafted HTML page triggers an out-of-bounds write (CWE-787) that a remote attacker can leverage to break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, the flaw carries a CVSS 9.6 due to its scope-changing memory-corruption impact, but there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as none. A vendor patch is already available, so the practical priority is rapid browser updating rather than emergency mitigation.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.46) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. This is an out-of-bounds write (CWE-787) rated High by Chromium and scored CVSS 8.3. There is no public exploit identified at time of analysis and CISA SSVC lists exploitation as 'none', though the technical impact is rated 'total'.
Sandbox escape in Google Chrome for macOS (versions prior to 150.0.7871.46) stems from an out-of-bounds write in ANGLE, the graphics abstraction layer that translates WebGL/OpenGL ES calls to native backends (Metal on Mac). A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU/graphics process to potentially break out of the renderer sandbox. There is no public exploit identified at time of analysis; Google rated the Chromium severity as Medium, and CISA's SSVC framework marks exploitation as none, though the CVSS base score is 9.6 due to the scope-changing sandbox-escape impact.
Out-of-bounds read in the Dawn WebGPU implementation of Google Chrome before 150.0.7871.46 lets a remote attacker who lures a victim to a crafted HTML page potentially escape the renderer sandbox and disclose out-of-bounds memory. The upstream Chromium team rated the security severity as Low, yet the associated CVSS 3.1 base score is 9.6 due to a scope change and high triad impact. There is no public exploit identified at time of analysis, and the CISA SSVC decision framework records exploitation as none and automatable as no.
Out-of-bounds memory access in Google Chrome's Tint component (the WGSL shader translator inside the Dawn/WebGPU stack) affects all desktop builds prior to 150.0.7871.46 and lets a remote attacker corrupt memory when a victim opens a crafted HTML page. Chromium rates the severity High and the CVSS 3.1 score is 8.8, driven by high confidentiality, integrity, and availability impact requiring only that the user visit a malicious page. No public exploit identified at time of analysis, and the low EPSS score (0.19%, 9th percentile) indicates exploitation is not currently widespread.
Sandbox escape in Google Chrome's Dawn WebGPU implementation prior to 150.0.7871.46 lets a remote attacker use a crafted HTML page to trigger an out-of-bounds read and write, potentially breaking out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 (scope-changed), it requires the victim to visit a malicious page but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's Skia graphics library (versions before 150.0.7871.46) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated Medium by Chromium but scored CVSS 8.3 due to scope change and total impact; there is no public exploit identified at time of analysis and SSVC reports no observed exploitation. Realistically it is a second-stage bug that must be chained with a prior renderer compromise, which raises the practical difficulty.
Sandbox escape in Google Chrome's Skia graphics library affects all desktop builds prior to 150.0.7871.46, where an integer overflow triggered by a crafted HTML page can break out of the renderer sandbox into the more-privileged browser process. A remote attacker who lures a victim to a malicious page could potentially compromise the host beyond the rendering sandbox. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none'.
Heap corruption in the V8 JavaScript engine of Google Chrome before 150.0.7871.46 lets a remote attacker who lures a user to a crafted HTML page and coaxes them into specific UI gestures potentially achieve memory corruption and code execution in the renderer. The flaw was reported internally by the Chrome team and is patched in the Stable channel; no public exploit identified at time of analysis, and EPSS is low (0.18%, 8th percentile). Note the tension in the signals: NVD/aggregator CVSS is 8.8 (High) while Google's own Chromium severity rating is Low.
Arbitrary code execution within the renderer sandbox affects Google Chrome desktop versions prior to 150.0.7871.46, where an inappropriate implementation flaw in the V8 JavaScript engine lets a remote attacker run code confined to the browser sandbox after a victim opens a crafted HTML page. Google rated the Chromium severity as Medium, and the code execution is explicitly described as occurring inside the sandbox rather than as a full sandbox escape. There is no public exploit identified at time of analysis and the vulnerability is not on CISA KEV, with a low EPSS score of 0.28% (20th percentile).
Sandbox escape in Google Chrome desktop before 150.0.7871.46 is possible through a heap buffer overflow in the Skia graphics library, letting an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a second-stage bug: it presumes prior renderer code execution rather than granting initial access on its own. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none.
Out-of-bounds memory access in Google Chrome's ANGLE graphics component on macOS lets a remote attacker corrupt heap memory when a victim opens a crafted HTML page in versions before 150.0.7871.46. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication; there is no public exploit identified at time of analysis and it is not on CISA KEV, with a low EPSS of 0.21% (11th percentile). A vendor patch is available.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets a remote attacker crash the device by sending crafted input to the gohead/sub_448384 (FUN_00448384) handler, triggering a stack-based buffer overflow. The CVSS 3.1 vector marks it network-reachable and unauthenticated with high availability impact but no confidentiality or integrity effect. Publicly available exploit code exists via a GitHub CVE report; there is no CISA KEV listing and no EPSS score in the provided data.
Denial of service in ClamAV's DMG file format parser allows a remote, unauthenticated attacker to crash the scanning engine by submitting a crafted Apple Disk Image (DMG) for inspection. The flaw stems from an integer overflow triggered during boundary checks on DMG content and manifests only on 32-bit builds of ClamAV; memory corruption raises the theoretical possibility of expanded impact beyond a crash, though only DoS is described. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in ClamAV's ALZ archive parser allows an unauthenticated, remote attacker to crash the scanning engine by submitting a crafted ALZ file, with the vendor noting possible expanded impact beyond DoS. The flaw is a heap out-of-bounds write triggered during scanning, and because ClamAV is commonly deployed as an automated mail/upload gateway scanner, an attacker only needs to get a malicious file scanned. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Availability-impacting out-of-bounds write in ClamAV's PESpin file-format parser lets an unauthenticated remote attacker crash the scanning engine by submitting a crafted PESpin-packed file for scanning. Because ClamAV frequently sits inline on mail gateways, file-upload paths, and proxies, a single malicious sample can terminate the scanning process and produce a denial of service; the memory corruption may permit expanded impact beyond DoS though only crash impact is confirmed. There is no public exploit identified at time of analysis and it is not on CISA KEV, with EPSS not provided.
Denial of service in ClamAV's 7z archive scanner allows a remote, unauthenticated attacker to crash the scanning process by submitting a crafted 7z file, resulting in an out-of-bounds heap write (CWE-120). Because ClamAV is commonly deployed inline on mail gateways and upload-scanning pipelines, a single malicious attachment can be delivered without any interaction or credentials. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, though Cisco (ClamAV's maintainer) rates confidentiality/integrity impact as none and availability as high.
Denial of service in ClamAV's FSG file format parser allows an unauthenticated remote attacker to crash the scanning engine, and potentially achieve broader memory-corruption impact, by submitting a crafted FSG-compressed portable executable to be scanned. The flaw stems from an out-of-bounds buffer write during FSG decompression, affecting any deployment that scans attacker-supplied files. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network-reachable, no-authentication, no-interaction nature (CVSS 7.5) makes it a meaningful availability risk for mail/file-scanning gateways.
Denial of service in ClamAV's PE (Portable Executable) file format parser lets an unauthenticated, remote attacker crash the scanning engine by submitting a crafted PE file for scanning, triggering an out-of-bounds buffer write (CWE-120). Reported by Cisco PSIRT (ClamAV's maintainer), the flaw carries CVSS 7.5 with an availability-only impact; the advisory notes memory corruption could 'possibly' enable expanded impacts beyond DoS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) returned in fno.fname are copied by downstream callers into short fixed-size buffers without bounds checks, corrupting memory in the embedded application. Reported by runZero, this is a downstream-caller (CWE-120) pattern affecting integrations of the popular ChaN FatFs embedded filesystem library rather than a defect in FatFs core parsing itself. Publicly available exploit code exists (SSVC Exploitation: PoC, runZero GitHub repo) with total technical impact, though the physical attack vector (AV:P) meaningfully constrains real-world reach; no CISA KEV listing.
Stack-based buffer overflow in FatFs R0.16 and earlier allows an attacker who can present crafted exFAT media to corrupt the stack via f_getlabel(), because the exFAT volume-label length field (XDIR_NumLabel) is trusted without enforcing the specification maximum. FatFs is an embedded FAT/exFAT filesystem library used across microcontroller and IoT firmware, so any device that mounts and reads the label of attacker-supplied storage is exposed. Publicly available exploit code exists (runZero advisory and SSVC 'PoC'), but there is no public exploit identified in active use and it is not listed in CISA KEV.
Integer overflow in ELM-Chan FatFS R0.16 and earlier lets a crafted FAT32 volume corrupt file-size metadata during mount_volume(), where `fasize *= fs->n_fats` wraps and produces attacker-controlled, oversized read lengths in downstream callers. The affected code is a widely embedded FAT filesystem library used across microcontrollers and IoT firmware, and while primarily triggered by mounting malicious media, the vendor notes remote delivery is feasible via OTA/update pipelines. Publicly available exploit code exists (runZero research and proof-of-concept repository); no public exploit identified as actively used and it is not listed in CISA KEV.
Boot-time denial of service affects Rust-enabled Linux kernels on arm64 when both CONFIG_UNWIND_TABLES and CONFIG_UNWIND_PATCH_PAC_INTO_SCS are set and the kernel is built with rustc older than 1.98.0. A rustc bug omits the module-level uwtable annotation, so compiler-generated constructors (e.g. KASAN's asan.module_ctor) carry incorrect DWARF unwind data; the shadow-call-stack (SCS) boot patcher then rewrites the paciasp but not the matching autiasp instruction, corrupting the constructor and triggering a KASAN global-out-of-bounds fault and kernel panic during do_ctors() at boot. This is a self-inflicted toolchain/config interaction rather than an attacker-driven flaw - no public exploit identified at time of analysis, not in CISA KEV, and EPSS is only 0.16% (5th percentile).
Out-of-bounds read in the Linux kernel's AMD Display (amdgpu DRM) DisplayPort code allows a local attacker - or a malicious/attacker-controlled DisplayPort sink - to trigger a one-element over-read of the aux_rd_interval[] array in dp_get_eq_aux_rd_interval(). The array in struct dc_lttpr_caps holds only MAX_REPEATER_CNT-1 (7) entries but is indexed with an offset up to MAX_REPEATER_CNT (8) when a sink advertises 8 LTTPR repeaters via DPCD, reading aux_rd_interval[7]. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%, 6th percentile), and the vendor has released fixed kernel versions.
Heap overflow in the Linux kernel's AMD GPU display driver (drm/amd/display) arises because dal_vector_reserve() computes its allocation size as "capacity * struct_size" in 32-bit arithmetic, which can silently wrap to a small value and cause krealloc() to return an undersized buffer. A local, low-privileged user with access to the DRM/amdgpu device can trigger out-of-bounds heap writes on subsequent vector appends, potentially corrupting kernel memory. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile); the issue is fixed and rated CVSS 7.0 (High).
Remote code execution in the UltraVNC repeater (through version 1.8.2.2) allows an unauthenticated attacker who can reach the built-in HTTP administration port (default TCP 80) to overflow a fixed 1000-byte global buffer and corrupt adjacent .bss globals, leading to arbitrary code execution on the host. The flaw lives in wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c, where the request URI is copied via unchecked sprintf before any authentication check runs. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 combined with pre-auth network reachability makes this a high-priority issue.
Remote code execution in the UltraVNC Viewer (all versions through 1.8.2.2) stems from an integer overflow in the RFB failure-response parser: a malicious or man-in-the-middle VNC server can send a reasonLen of 0xFFFFFFFF that wraps to 0 during buffer sizing, then stream 4 GiB into a 256-byte heap allocation. The flaw is reachable pre-authentication through connection-failure and auth-failure messages, so merely connecting a viewer to an attacker-controlled endpoint can corrupt the heap and potentially execute code as the user running the viewer. No public exploit identified at time of analysis, though the researcher confirmed a reliable heap-buffer-overflow write with AddressSanitizer.
Denial of service in the UltraVNC viewer (vncviewer) through 1.8.2.2 arises from an off-by-one stack buffer overflow in the RFB ServerInit message handler, where a malicious VNC server advertising a desktop name of exactly 2024 bytes forces ReadString to write a NUL terminator at _dn[2024], one byte past a 2024-byte stack buffer. A rogue or compromised server can crash victims who connect to it (reliable process termination on /GS-hardened builds) and potentially corrupt adjacent stack data on canary-less release builds. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation requires the victim to initiate a connection to the attacker-controlled server.
Remote code execution in the UltraVNC Repeater (through version 1.8.2.2) allows an authenticated administrator to corrupt stack memory via the web GUI allow/deny rule parser, ultimately achieving code execution on the repeater host. The flaw (CWE-787, out-of-bounds write) is reachable only after admin login, but that barrier is significantly weakened when chained with CVE-2026-7839 (default password), which can hand an attacker the required credentials. There is no public exploit identified at time of analysis and no EPSS/KEV data supplied, so this is currently a credentialed, chainable RCE rather than a confirmed mass-exploited threat.
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a rogue base station to corrupt modem memory via a missing bounds check (out-of-bounds write, CWE-787). Once a target UE camps on the attacker-controlled cell, exploitation requires no user interaction and no pre-existing privileges, potentially yielding privilege escalation within the modem subsystem. Tracked in MediaTek's July 2026 Product Security Bulletin (Patch ID MOLY01402160); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in the RAR5 recovery-volume (.rev) parser of WinRAR, RAR, UnRAR, and unrar.dll (versions before 7.23) lets an attacker corrupt heap memory when a victim runs a recovery, test, or repair operation on a crafted multi-file .rev set. Because subsequent .rev files supply a RecNum value validated only against their own TotalCount and never against the actual RecItems allocation, an attacker-controlled 32-bit value can be written far past the buffer, enabling memory corruption and potential code execution. There is no public exploit identified at time of analysis, but this is the RAR5-path sibling of the previously exploited CVE-2023-40477, and CWE-787 flaws in WinRAR have historically led to reliable RCE.
Heap-based buffer overflow in libde265, the open-source H.265/HEVC video codec library by strukturag, allows remote unauthenticated attackers to trigger memory disclosure and denial-of-service by supplying a specially crafted HEVC-encoded input. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) indicates network-reachable exploitation requiring high complexity but no authentication or user interaction, consistent with server-side media processing pipelines. No public exploit code and no CISA KEV listing are confirmed at time of analysis. Ubuntu has issued USN-8573-1 and a vendor patch is available via the strukturag GitHub advisory GHSA-j2qq-x2xq-g9wr.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash the device by triggering a buffer overflow in the gohead/sub_425994 (FUN_00425994) web-server routine. Publicly available exploit/PoC documentation exists (GitHub CVEreport), and the SSVC framework rates exploitation as PoC-stage and automatable, though EPSS remains low at 0.22% (13th percentile) with no confirmed active exploitation.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash the device by triggering a buffer overflow in the gohead/sub_447CAC web-server routine. Publicly available exploit code exists (referenced GitHub CVEreport analysis) but it is not listed in CISA KEV; EPSS is low at 0.22% (13th percentile), indicating no observed widespread exploitation. Note a data conflict: the description and tags describe a DoS, yet the supplied CVSS vector encodes a confidentiality impact (C:H/A:N) rather than availability.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the renderer sandbox via a crafted HTML page. The flaw is a CWE-787 out-of-bounds read and write; Google's own Chromium team rated the security severity as Low, and there is no public exploit identified at time of analysis. EPSS estimates only a 0.17% (7th percentile) chance of exploitation, and the vulnerability is not listed in CISA KEV.
Out-of-bounds memory read in the CameraCapture component of Google Chrome on ChromeOS (versions prior to 150.0.7871.47) lets a remote attacker leak adjacent process memory when a victim opens a crafted HTML page. No public exploit identified at time of analysis, and EPSS is low (0.17%), but the flaw is marked automatable by CISA SSVC. Note a signal conflict: the NVD CVSS is 8.1 (high) while Google rates the Chromium security severity as Low.
Heap corruption in Google Chrome's WebNN (Web Neural Network API) implementation on Windows, fixed in 150.0.7871.47, lets an attacker who has already compromised the renderer process trigger a heap buffer overflow via a crafted HTML page and potentially escalate beyond the sandbox. Chromium's own security team rated this Low severity, while NVD scores it 8.8; EPSS is low at 0.19% (9th percentile) and there is no public exploit identified at time of analysis. It is not listed in CISA KEV and SSVC records exploitation status as none.
Out-of-bounds memory read in the SurfaceCapture component of Google Chrome before 150.0.7871.47 lets a remote attacker leak adjacent heap memory when a victim opens a crafted HTML page. Chromium rated the flaw Medium severity, though the associated CVSS is 8.1; there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.17% (7th percentile), consistent with a browser bug fixed pre-disclosure. Successful exploitation could disclose sensitive in-process data or crash the renderer, and typically serves as one link in a larger sandbox-escape chain rather than standalone compromise.
Navigation restriction bypass in Google Chrome on macOS prior to 150.0.7871.47 lets a remote attacker evade Safe Browsing protections by luring a victim into opening a malicious file, via an integer overflow in the Safe Browsing component. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The practical effect is that a security warning meant to block dangerous navigations can be defeated, not direct code execution.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no authentication, and the flaw carries a CVSS 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), indicating no evidence of widespread exploitation despite the high CVSS.
Out-of-bounds memory write in Google Chrome's Fonts component (versions prior to 150.0.7871.47) lets a remote attacker corrupt heap memory when a victim renders a crafted HTML page, creating a path toward renderer-process code execution. The flaw stems from an integer overflow during font handling and requires only that the target open an attacker-controlled page. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Heap-based integer overflow in Google Chrome's Chromecast component allows an adjacent-network attacker to achieve arbitrary code execution against browsers running versions prior to 150.0.7871.47. The flaw is reachable via crafted malicious network traffic and carries a high CVSS of 8.8; Google has shipped a stable-channel fix, and no public exploit has been identified at time of analysis. Chromium rates the underlying issue as Medium severity despite the high CVSS, reflecting the adjacency and interaction constraints.
Sandbox escape in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the sandbox and execute code in the more privileged browser context via a crafted HTML page. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and SSVC records exploitation status as none.
Heap corruption in Google Chrome's XML implementation on all desktop platforms prior to 150.0.7871.47 allows a remote attacker to potentially achieve code execution when a victim visits a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8 (network vector, user interaction required), this is a memory-safety flaw (CWE-122 heap-based buffer overflow) reported through Google's internal CVE process. There is no public exploit identified at time of analysis, and SSVC assessment shows exploitation status of none with a low EPSS of 0.21%.
Out-of-bounds read/write (use-after-free) in Google Chrome's GPU component lets a remote attacker who has already compromised the renderer process run arbitrary code - though still confined inside the sandbox - by serving a crafted HTML page to a Chrome build prior to 150.0.7871.47. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and EPSS puts near-term exploitation probability at just 0.26%.
Out-of-bounds memory read in the ANGLE graphics component of Google Chrome on macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process read memory outside intended bounds via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it functions as a chained post-exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Affects Chrome desktop versions prior to 150.0.7871.47, rated High by Chromium with a CVSS of 8.3. There is no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records exploitation as none.
Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 stems from a heap buffer overflow in the Chromecast component, letting an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, but it is a second-stage bug requiring prior renderer control, and there is no public exploit identified at time of analysis (SSVC exploitation: none, EPSS 0.22%). No CISA KEV listing exists, indicating no confirmed active exploitation.
Sandbox escape in Google Chrome's Chromecast component before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to the more privileged browser process. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change; however, EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.
Denial of service in the msgpack-python serialization library (versions prior to 1.2.1) lets remote attackers crash a process via an out-of-bounds read when an application reuses an Unpacker instance after a previously raised error was caught. Sending malformed MessagePack data that triggers an error, then feeding further data to the same Unpacker, can drive the process to a SEGV. No public exploit has been identified at time of analysis, and EPSS data was not provided, but the CVSS 3.1 score of 7.5 (availability-only) reflects a straightforward, unauthenticated crash condition.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets a remote, unauthenticated attacker crash the device by triggering a buffer overflow in the gohead web-service function sub_416f28 (FUN_00416f28). Publicly available exploit code exists (referenced PoC on GitHub), though the flaw is not listed in CISA KEV and EPSS scores it at just 0.22% (13th percentile), indicating low observed exploitation activity. Impact is limited to availability - no code execution or data exposure is claimed in the source data.
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.
Memory-corruption weaknesses in Mozilla Firefox 152.0.3 could allow remote attackers to potentially execute arbitrary code within the browser process. Mozilla graded the collected memory-safety bugs as critical (MFSA2026-62) and states some showed evidence of memory corruption that, with sufficient effort, could be exploited for code execution; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). The issue is resolved in Firefox 152.0.4.
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that produce unpredictable or erroneous behavior when the appliance is configured for specific DNS or load-balancing roles. Remote unauthenticated attackers can send crafted traffic to a vulnerable appliance to crash or destabilize it, with the CVSS 4.0 score of 8.8 driven primarily by high availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated attackers to trigger unpredictable or erroneous appliance behavior when the device is deployed as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication, and the high confidentiality impact suggests memory contents may be exposed alongside the DoS condition. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the appliance is configured as a SAML identity provider (IDP), enabling disclosure of sensitive in-memory data such as tokens, session material, or other process memory. The CVSS 4.0 score of 8.8 reflects network-reachable, unauthenticated exploitation (PR:N) with high confidentiality and availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The flaw belongs to the same class of NetScaler appliance vulnerabilities (e.g., Citrix Bleed-style memory disclosure) that have historically drawn aggressive exploitation, making prompt patching advisable.
Denial of service in hostapd 2.11 through pre-2.12 development snapshots (built with CONFIG_IEEE80211BE) lets an unauthenticated attacker within wireless range crash the access-point daemon by sending a crafted Wi-Fi 7 (802.11be) Multi-Link association request. A malformed Multi-Link Element or Per-STA Profile subelement supplies a link_id of 15 that overruns the 15-entry (0-14) links[] array, causing an out-of-bounds write before the 4-way handshake. No public exploit identified at time of analysis; EPSS is low (0.29%, 20th percentile) and CISA SSVC rates exploitation as none.
Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-Bus introspection XML that nests a <node> element inside <method>, <signal>, <property>, or <arg>. This state-confusion bug triggers an unsigned integer underflow/overflow (CWE-191) and a subsequent out-of-bounds read, crashing any application or service that parses attacker-influenced introspection data. No public exploit identified at time of analysis, EPSS is low (0.34%), and CISA SSVC rates exploitation as none with only partial technical impact.
Buffer over-read in GLib's giochannel line-reading code (g_io_channel_read_line_backend) affects the GNOME GLib library prior to version 2.88.1, where an application that configures a multi-byte custom line terminator triggers memcmp to read past the end of the internal GString buffer. Depending on memory layout, this leaks up to 7 bytes of adjacent heap memory (minor information disclosure) or crashes the process when the over-read crosses an unmapped page boundary (denial of service). There is no public exploit identified at time of analysis, EPSS is low (0.27%), and CISA SSVC rates exploitation as none.
Buffer over-read in GNOME GLib's g_regex_replace() lets remote attackers leak 1-5 adjacent bytes of process memory and crash applications when regex replacement is performed with the G_REGEX_RAW compile flag combined with case-change replacement escapes. The internal string_append helper applies UTF-8 aware routines to matched substrings even though G_REGEX_RAW treats the buffer as raw bytes, reading past the intended boundary. There is no public exploit identified at time of analysis and EPSS is low (0.26%, 18th percentile), but the flaw is broadly reachable because GLib underpins the GNOME stack and ships across Red Hat Enterprise Linux 6-10.
Out-of-bounds read of two bytes in GLib's g_date_time_get_ymd() (glib/gdatetime.c) lets attackers corrupt date output and trigger logic errors that may cause denial of service when an application processes an invalid GDateTime produced by g_date_time_add_full(). It affects the GNOME GLib core utility library shipped across Red Hat Enterprise Linux 6 through 10, with fixes in GLib 2.88.1 and 2.86.5. There is publicly available exploit code exists per SSVC (proof-of-concept), no confirmed active exploitation, and EPSS is low at 0.27% (19th percentile).
Out-of-bounds read in GNOME GLib's GVariant serialiser allows remote attackers to leak a single byte of adjacent memory and to crash applications that deserialise untrusted GVariant data. The flaw sits in gvs_tuple_is_normal() in glib/gvariant-serialiser.c, where an alignment-padding bounds check uses '>' instead of '>=', reading one byte past the buffer; when that byte falls across a page boundary the process faults, producing a denial of service. No public exploit identified at time of analysis, and EPSS is low (0.26%), but GLib's near-universal presence on Linux systems makes the exposure broad.
Denial of service in the UTT nv518G gateway/router (firmware nv518GV3 v3.2.7-210919-161313) allows a remote, unauthenticated attacker to crash the device by triggering a buffer overflow in the gohead web-service handler at function sub_472f08 (FUN_00472f08). The CVSS 3.1 score of 7.5 reflects availability-only impact (A:H, C:N/I:N) over the network with no privileges or user interaction. EPSS is low (0.22%, 13th percentile) and the CVE is not in CISA KEV; a third-party technical write-up exists on GitHub, but no active exploitation is confirmed.
Memory corruption via use-after-free in Apple's WebKit browser engine allows remote attackers to corrupt memory when a victim processes maliciously crafted web content on Safari, iOS/iPadOS, or macOS prior to 26.5.2. The CVSS 3.1 score of 8.8 reflects network-reachable exploitation requiring only that a user open a malicious page; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV. Successful exploitation typically serves as the initial stage of a browser-based attack chain (often paired with a sandbox escape) to achieve code execution in the renderer.
Memory corruption via type confusion in Apple's WebKit browser engine allows attackers to corrupt memory by luring a victim to maliciously crafted web content, affecting Safari, iOS/iPadOS, and macOS before version 26.5.2. The flaw (CWE-843) is network-reachable but requires user interaction (visiting a page), and no public exploit has been identified at time of analysis. Apple has shipped patches across Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2.