Buffer Overflow
Monthly
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
Integer overflow in the FreeRDP client's Apple/CoreAudio audio-input (audin) backend, present in all versions before 3.31.0, allows a malicious or compromised RDP server to corrupt memory on the connecting client. The server sends an MSG_SNDIN_OPEN message carrying a crafted FramesPerPacket value that wraps the size arithmetic used by AudioQueueAllocateBuffer, producing an undersized allocation that is then written past its bounds during audio capture. Impact is bounded to the client (CVSS 5.3, all impacts Low, UI:P — the victim must initiate a connection to the hostile server); patch status is 'available from vendor' with a fix in 3.31.0, and no public exploit or CISA KEV entry was identified at time of analysis.
Opening a crafted .rdp connection file in the FreeRDP xfreerdp X11 client (versions 3.11.0 through 3.30.0) can trigger out-of-bounds heap reads and writes because the client fails to validate MonitorIds array values in xf_detect_monitors. This local, user-interaction-gated flaw requires a victim to open the malicious file and does not affect the RDP server side; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). The vendor has released a patch in FreeRDP 3.31.0, and the CVSS 6.9 rating reflects limited confidentiality and integrity impact with a high availability impact.
Heap buffer overflow in the NGINX HTTP/3 module (ngx_http_v3_module) can crash NGINX worker processes or corrupt a limited amount of heap data when NGINX Plus or NGINX Open Source serves QUIC traffic while linked against OpenSSL 3.5.0 or earlier under certain configurations. The overflow occurs while processing a TLS handshake and is non-deterministic — triggering it is largely outside the attacker's control — so the realistic outcome is opportunistic denial of service (worker restart) plus limited data corruption rather than reliable remote code execution. There is no control plane exposure (data plane only), no public exploit identified at time of analysis, and no CISA KEV listing; EPSS data was not provided.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
Rendering a crafted Lottie vector animation with Samsung's open-source rLottie library can overflow a fixed-size stack buffer during run-length-encoding of render spans, corrupting memory in the host application. The flaw affects rLottie builds at revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39 and is rated only 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) because an attacker must induce the victim application to render a malicious animation; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. An upstream fix exists in Samsung/rlottie pull request 607, which increases the span array capacity and adds explicit bounds checks.
Memory corruption in GPAC's scenegraph node management routine `gf_node_list_insert_child` (in `scenegraph/base_scenegraph.c`) can be triggered by a remote attacker delivering a crafted MPEG-4/BIFS scene file, causing a process crash (DoS). A publicly available proof-of-concept exploit (`poc_18_nstatx.zip`) is distributed via GitHub, lowering the exploitation bar. All GPAC releases up to commit f1219cde are affected; version abi-16.23 resolves the issue. No confirmed active exploitation campaign (not in CISA KEV) has been identified at time of analysis.
Stack exhaustion via unbounded recursion in GPAC's scenegraph node activation routine allows a local attacker to crash the application or corrupt memory when a malicious or malformed multimedia scene file is opened. Affected versions up to commit f1219cde lack a recursion depth guard in gf_node_activate_ex and gf_node_deactivate_ex, enabling crafted cyclic or deeply nested VRML/X3D/XMT scene graphs to exhaust the call stack. A publicly available proof-of-concept (poc_17_nstatx.zip) exists; however, no active exploitation has been confirmed and impact is limited to low integrity and availability consequences on the local system.
Heap out-of-bounds access in GPAC's URL concatenation utility (`utils/url.c`) allows a local low-privileged attacker to trigger memory corruption when the `gf_url_concatenate_ex` function processes a crafted URL that results in an empty temporary buffer. The trailing-whitespace trim loop computes `tmp[strlen(tmp)-1]` without first checking that `tmp` is non-empty, accessing heap memory at index -1. Exploitation requires local system access and user interaction; no public exploit exists and the vulnerability is not listed in CISA KEV. The fix is available in GPAC release abi-16.23.
Heap-based buffer overflow in GPAC's MPEG Video Reframer filter exposes users of versions up to commit f1219cde to memory corruption when processing a malformed MPEG video file. The vulnerable function mpgviddmx_process() in filters/reframe_mpgvid.c previously relied on gf_assert() to validate MPEG start codes without first confirming the buffer contains at least 3 bytes, enabling heap corruption on crafted input. A proof-of-concept exploit has been publicly disclosed via GitHub; no CISA KEV listing or confirmed active exploitation exists at time of analysis.
CVE-2026-75883 is an Ubuntu security update with no technical details publicly disclosed at time of analysis. The description contains only the phrase 'security update,' providing no information about the vulnerability class, affected component, or attacker capabilities. No CVSS vector, CWE, or supplementary intelligence is available to characterize impact or exploitation conditions.
Memory corruption in GNU Binutils 2.47 is triggerable locally by supplying a crafted ELF file to any Binutils tool that invokes `_bfd_elf_strtab_delref` in `bfd/elf-strtab.c`. A low-privileged local attacker can corrupt heap memory in the BFD library's ELF string table handler, potentially causing process crash, limited information disclosure, or minor data manipulation. A public proof-of-concept exists per the CVSS 4.0 E:P modifier and CVE description; no vendor patch has been released as the upstream project had not yet responded to the bug report at time of disclosure.
Out-of-bounds write in the Zephyr RTOS ITE it51xxx I2C target driver allows a malicious or compromised I2C master to corrupt embedded controller firmware memory by sending a write transaction exceeding 256 bytes while the controller operates in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() accumulated bytes into a fixed-size buffer without a pre-write bounds check, enabling overflow into the adjacent target_out_buffer and following static device data in the interrupt handler context. No software privilege on the victim controller is required; the attacker needs physical or electrical access to the I2C bus with both CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE enabled. No public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.
A stack-based buffer overflow exists in GPAC 26.07.0 within the scene-graph DOM event handler gf_sg_dom_event_bubble (src/scenegraph/dom_events.c), reachable through the MP4Box tooling when it parses a crafted scene/BT/XMT media file. Exploitation is local only — the attacker must get a file processed by an affected build — and the disclosed impact is loss of availability rather than code execution or data disclosure. Publicly available exploit code exists (a PoC archive is linked from the advisory), but EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and the SSVC decision is exploitation=poc, automatable=no, technical impact=partial, so this is a low-priority, local, denial-of-service-class memory-safety bug rather than an urgent remote threat.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
An integer-overflow flaw (CWE-190) in Apple macOS lets an attacker who already occupies a privileged on-path network position crash or otherwise deny service to the affected system. The vulnerability is fixed in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8, so every earlier build of those three branches is exposed. There is no CISA KEV listing and no identified public exploit code, and EPSS places exploitation likelihood at roughly 0.17% (6th percentile), making this a routine patch-cycle item rather than an emergency for most fleets.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
Denial of service in Apple iOS, iPadOS, and macOS results from an integer overflow (CWE-190) that a locally installed and executing application can trigger to cause unexpected system termination. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) confirms local access with low privileges, no user interaction, and impact limited to availability - there is no confidentiality or integrity loss and no remote or network-triggerable path. This is a genuinely low-priority issue despite its MEDIUM rating: EPSS is 0.20% (10th percentile), no public exploit code was identified at time of analysis, there is no CISA KEV listing, and Apple has shipped fixed versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27), leaving exposure limited to unpatched devices on which an attacker can already run code.
Connecting an attacker-controlled hardware accessory to an unpatched iPhone, iPad, or Mac can drive a memory corruption fault that terminates the system (unexpected system termination) in iOS/iPadOS before 26.7 and before 27, and in macOS Tahoe before 26.7 and macOS Golden Gate before 27. The vendor describes the root cause as insufficient input validation (CWE-20) on data supplied by the attached peripheral; the vector requires no privileges on the target device (PR:N) but does require the victim to physically attach the malicious accessory and to interact with it (UI:R), and the impact is availability-only with no confidentiality or integrity loss. Apple has released fixes (iOS/iPadOS 26.7 and 27, macOS Tahoe 26.7 and macOS Golden Gate 27), the vendor score is 5.5, EPSS is 0.15% (5th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
A local out-of-bounds read in Apple macOS lets an already-installed and running application trigger an unexpected system termination, resulting in denial of service on the host it is running on. Exploitation requires local code execution as a low-privileged app (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) - there is no network vector, and the impact is confined to availability, with no data exposure or privilege escalation. The flaw affects pre-fix builds of macOS Sequoia (<15.8), macOS Tahoe (<26.7) and macOS Golden Gate (<27), and no public exploit has been identified at time of analysis; the independently assessed exploitation status is 'no public exploit identified at time of analysis' and EPSS is only 0.19% (9th percentile), consistent with a low-priority defensive item. Apple has released fixed versions, so remediation is a straightforward OS update.
An out-of-bounds write in Apple's operating systems - iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27 - allows a remote, unauthenticated attacker to crash the application that processes a maliciously crafted file, with the flaw addressed through improved bounds checking. Successful exploitation requires the victim to open or process the attacker-supplied file (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), and the realized impact is limited to termination of the processing app with no confidentiality or integrity effect and no system-wide crash. Vendor patches are available from Apple across all affected platforms, the EPSS score is low at 0.20% (10th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite the memory-corruption class.
Heap-based buffer overflow in Apple's operating system platforms - iOS and iPadOS (before 26.7 and 27), macOS Golden Gate (before 27), visionOS (before 27), and watchOS (before 27) - allows a remote attacker to crash the processing application by delivering a maliciously crafted file that the victim opens. Successful exploitation requires user interaction (CVSS UI:R) and leads only to unexpected termination of the affected app; there is no confidentiality or integrity impact and no described code execution or system-wide compromise, which is why our independent assessment lowers the availability impact to A:L rather than the vendor's A:H. No public exploit code has been identified at time of analysis and exploitation is not confirmed actively exploited (CISA KEV); EPSS is 0.18% (8th percentile), indicating a low predicted likelihood of exploitation. Vendor patches are available.
Opening a maliciously crafted file on an unpatched Apple device can crash the parsing process or disclose its memory contents, an out-of-bounds read that Apple addressed with improved input validation and fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), exploitation is unauthenticated from the network but hinges entirely on user interaction - the victim must open the crafted file - and impact is confined to the vulnerable process as a limited read-only disclosure or denial of service, with no code execution or data modification. EPSS is 0.18% (7th percentile), no public exploit has been identified at time of analysis, and vendor patches are already available, making this a low-priority issue despite the network attack vector.
An out-of-bounds read in Apple's font-processing code can crash (terminate) an application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS when it parses a maliciously crafted font file, but it cannot be used to execute code, escalate privileges, or steal data. The issue affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7 and Golden Gate 27, and tvOS, visionOS and watchOS before 27, and it is fixed in those listed releases; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, score 4.3) confirms that unauthenticated remote attackers can only succeed if a victim is induced to open or render the crafted font (user interaction required), and exploitation yields availability loss only. No public exploit code has been identified at time of analysis and the EPSS score is 0.21% (11th percentile), so real-world exploitation is unlikely; this is a genuinely low-priority issue despite the network attack vector.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
Unexpected system termination in Apple macOS is caused by an out-of-bounds read in the SMB client that is triggered when a user initiates a connection to a malicious or spoofed SMB server. The affected versions are macOS releases before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is a low 0.17% (6th percentile). An attacker who controls or spoofs the SMB endpoint the victim reaches can force a crash, with no privilege escalation, code execution, or data disclosure assessed.
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.
Mounting a maliciously crafted disk image or removable-media volume on an unpatched Apple device triggers a heap buffer overflow in the operating system's volume-parsing code, causing unexpected system termination (denial of service). Affected builds are iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate 27. Exploitation is gated by mandatory user interaction - the crafted volume must be attached and mounted by the victim - and the assessed impact is limited to system termination with no code execution, data disclosure, or persistence; EPSS is only 0.19% (9th percentile) and no public exploit code has been identified, though Apple has released patched versions and CISA KEV does not list this CVE. Real-world risk is LOW-to-MODERATE despite the 6.5 (Medium) CVSS, since the practical attack path is local/physical delivery rather than network reach.
Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Improper bounds checking during image processing on unpatched Apple operating systems lets a crafted image crash the application that renders it, affecting iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is scored 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), meaning an unauthenticated remote attacker can trigger it only if the victim opens or renders the malicious image, and the outcome is limited to unexpected application termination rather than code execution, data disclosure, or integrity loss. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is a low 0.21% (12th percentile), so this is a low-to-moderate priority issue rather than an emergency.
Out-of-bounds memory corruption in Apple's 3D scene processing pipeline lets a maliciously crafted scene file terminate the application that renders it across iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds released before the fixed versions. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (score 4.3): no authentication or elevated privileges are required, but the attacker cannot succeed without the victim opening or rendering the supplied scene, and the resulting impact is confined to application termination with no confidentiality, integrity, or demonstrated code-execution effect. No public exploit identified at time of analysis, EPSS is 0.18% (8th percentile), and Apple has shipped patches for every affected platform, making this a low-priority denial-of-service defect rather than a code-execution emergency.
An out-of-bounds write in the Apple macOS kernel allows a locally running application to corrupt kernel memory, potentially causing unexpected system termination or arbitrary kernel memory writes. The flaw affects macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, with a CVSS base score of 6.1 (AV:L/AC:L/PR:L/UI:N) reflecting the requirement for local code execution with attacker-controlled privileges. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.16%, 6th percentile), suggesting targeted rather than opportunistic exploitation; CISA KEV does not list this CVE.
An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.
Unexpected system termination can be triggered on Apple macOS when a locally running app - including one executed by a standard, non-administrative user - exercises a memory-handling defect in the operating system, causing the machine to crash. Affected builds are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27; the issue is a local, availability-only denial of service (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:N/A:H) with no demonstrated confidentiality or integrity impact and no privilege escalation. Publicly available exploit code exists (a public gist is referenced) but there is no CISA KEV listing, and exploitation is confirmed only as a proof-of-concept rather than confirmed actively exploited activity; EPSS is 0.17% (6th percentile), reinforcing that mass exploitation is unlikely.
An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.
An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
Mounting a maliciously crafted exFAT volume on an unpatched macOS system (versions before Golden Gate 27) can trigger an out-of-bounds read in the kernel, leading to kernel memory disclosure or unexpected system termination. Exploitation requires user interaction to mount the attacker-supplied volume, and no public exploit code or active exploitation has been identified at time of analysis (EPSS 0.16%).
Processing a maliciously crafted image on unpatched Apple devices can trigger a memory-corruption fault that crashes the affected process, producing a local denial-of-service (CVSS 3.1 base 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected platforms are iOS and iPadOS before 18.7.10 and macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Golden Gate 27; the attacker cannot trigger the flaw remotely and must get the victim to open or auto-render the crafted image. All signals point to a low-priority issue: EPSS is 0.20% (10th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are already available.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.
Mounting a crafted disk image on an affected Mac can crash the system: Apple macOS Sequoia, Tahoe and Golden Gate contain a buffer overflow in the disk-image handling path that is triggered when a user opens a malicious image, requiring no credentials. Apple has shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. EPSS is low (0.19%, 8th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical concern is availability loss (forced termination, potential unsaved-work loss) rather than code execution.
Kernel memory corruption in Apple macOS lets a locally running application crash the operating system or corrupt kernel memory, with the potential for further kernel-level compromise. The flaw is a memory-bounds handling defect (CWE-119) present in macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and is fixed in those releases per Apple's advisories. Exploitation requires the ability to execute code as a local user (CVSS AV:L/PR:L), EPSS is low at 0.19% (9th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
A use-after-free and double-free race in Zephyr's TLS socket session cache lets a malicious or compromised TLS peer corrupt the mbedTLS heap and crash an affected device. The flaw is reachable only by applications that explicitly enable the TLS_SESSION_CACHE socket option (off by default) and run concurrent TLS client connections from multiple threads, since the process-global client_cache defaults to a single shared slot. A vendor fix exists in commit 7f9d8ee (shipping in Zephyr 4.4.2 per the EUVD version range), and no public exploit code or active exploitation has been identified.
Stack-based buffer overflow in MikroTik RouterOS's mtget binary TFTP RRQ builder allows any authenticated user, including those with only read-only group membership, to crash the mtget worker process by issuing a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow involves an unbounded rep movsb instruction that overwrites saved registers at a deterministic stack offset, causing a reproducible process crash without requiring network connectivity to an actual TFTP server. No public exploit code has been identified at time of analysis, and vendor patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).
GNU Binutils 2.47 contains a heap out-of-bounds write in the ELF `.eh_frame` handler `_bfd_elf_write_section_eh_frame`, triggered when a malformed object file causes the library to compute a negative size that is then passed to a `memmove` during section rewriting. The attack is local: an attacker must get a crafted ELF file processed by a BFD-based tool (such as `ld`, `objcopy`, or `strip`) on the target system, after which the process can corrupt heap memory and crash. Exploit code is publicly available, though the CVSS 4.0 base score is only 0.9 because the required privileges, user interaction, and limited observed impact keep real-world severity low; there is no CISA KEV listing, and upstream has not responded to the bug report.
A heap out-of-bounds read/write leading to a buffer overflow exists in the GNU linker (ld), part of GNU Binutils 2.47, inside the elf_x86_64_relocate_section() function of bfd/elf64-x86-64.c, triggered when the linker processes a malformed x86-64 relocation entry whose roff argument is not validated. Exploitation is local — an attacker must supply a crafted ELF object file to a link operation — and yields only limited confidentiality, integrity and availability impact (CVSS 4.0 base 1.9), but publicly available exploit code exists and a heap OOB write/SEGV proof-of-concept has been published. The flaw is fixed in Binutils 2.48 via upstream commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b; it is not listed in CISA KEV, so active in-the-wild exploitation is not confirmed.
Local denial of service in SSSD's PAM responder occurs when a local process with access to the responder's UNIX socket negotiates legacy PAM protocol v1 and sends an empty or truncated request body. The out-of-bounds read in pam_parse_in_data() can terminate or restart the responder, causing availability loss for local authentication. This is a low-severity issue (CVSS 4.0, EPSS 0.12%, 2nd percentile) with no public exploit identified at time of analysis and no confirmed active exploitation in the provided data; exploitation requires a local foothold that can reach the socket and explicitly negotiate protocol v1.
GNU Binutils 2.47 contains a heap buffer overflow in cache_bwrite (bfd/cache.c) that is reachable when the GNU linker 'ld' processes a malformed ELF object file with the --gc-sections and -w options. Exploitation is local and low-impact per the vendor vector (CVSS 4.0 base 1.9, AV:L/PR:L, C/I/A:L), but publicly available exploit code exists, confirming the overflow is reproducible against a released version. The issue was reported upstream via Sourceware Bugzilla bug 34442 and, per the vulnerability record, the project has not responded, so no fixed release has been identified.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Memory corruption in marcobambini Gravity scripting language versions 0.9.0 through 0.9.7 allows remote attackers with low-privilege access to trigger undefined behavior via crafted JSON input processed by gravity_json.c, potentially causing a crash or exploitable memory state in embedding applications. The root cause is a two-pass JSON parser design flaw where u.object.values is used as a size counter during the first pass but incremented with pointer arithmetic on a null pointer - undefined behavior per the C standard, confirmed to trap under -fsanitize=undefined. A publicly available proof-of-concept exists as GitHub issue #448; no active exploitation has been identified in the wild.
Stack-based buffer overflow in Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* allows an authenticated remote attacker to trigger a denial-of-service condition by sending a specially crafted network request. The overflow (CWE-121) corrupts stack memory, crashing the device firmware without evidence of code execution capability. No public exploit or KEV listing exists; JPCERT/CC published the advisory coordinated with Contec.
Out-of-bounds write in CONPROSYS nano Series Remote I/O Coupler Units from Contec Co., Ltd. enables remote attackers with low-privilege network access to crash affected industrial automation devices by sending specially crafted network requests. Affected hardware includes server-type couplers (CPSN-MCB271), EtherNet/IP adapter variants (CPSN-EOB471EI), and software PLC-type units (CPSN-PCB271-S1-041), placing operational technology environments at risk of physical process disruption from device-level DoS. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Buffer overflow in the Panasonic Industry USB Driver for MINAS A5/A6 servo drives allows a local low-privileged attacker to crash Windows on machines running PanaTerm or RTEX LogReader software. The root cause is classic unchecked buffer copy (CWE-120) in the driver component bundled with the affected Panasonic software titles. Impact is limited to availability - a successful exploitation stops the Windows OS, but no confidentiality or integrity impact has been identified.
Memory corruption in GPAC's BIFS Text (BT) scene parser allows a remote attacker to crash the MP4Box process or corrupt process memory by supplying a crafted BT scene file. The primary defect in `gf_bt_parse_bifs_command()` (loader_bt.c:2812) is a format-string mismatch: the variable `str` is embedded in the format literal passed to `gf_bt_report` rather than supplied as a variadic argument, causing the `%s` specifier to dereference an uncontrolled stack or heap value. The patch (commit afca1f1181668d85941d51ed1adf647807d5d975, release abi-16.23) bundles several related fixes across the codebase; a public proof-of-concept exists but no confirmed active exploitation has been recorded.
Heap-based buffer overflow in jhead up to 3.3 allows a local attacker with low privileges to corrupt process memory by supplying a crafted WebP image with malformed GPS EXIF tags (TAG_GPS_LAT or TAG_GPS_LONG) to the ProcessGpsInfo() function in gpsinfo.c. A proof-of-concept has been publicly released via GitHub, and the project maintainer has not responded to the responsible disclosure report. No vendor-released patch is available at time of analysis.
Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.
Heap buffer overflow in SWF (Shockwave Flash) decompression depth handling affects a file analysis engine - most likely ClamAV, based on the 'detect/file_data' module path and Ubuntu as the reporting vendor. An attacker can supply a specially crafted SWF file that, when scanned, triggers out-of-bounds writes on the heap during recursive or depth-tracked decompression, potentially leading to process crash or arbitrary code execution within the scanning daemon. No patch version, CVSS vector, or CWE is included in the input; no public exploit is identified at time of analysis.
Out-of-bounds write in the Samsung Exynos camera driver error-handling path causes memory corruption on eight Exynos mobile processor variants. Exploitation requires local access with low privileges and high attack complexity to reach the faulty error path, with a changed scope producing only low availability impact - consistent with a crash or transient DoS rather than code execution. No public exploit code exists and the vendor has published a security update via the Samsung Semiconductor support portal.
Unchecked strcpy() of the GZIP original-filename header field in libarchive 3.8.x causes a heap-based buffer overflow (CWE-122) in the gzip compression writer, with impact limited to a low-severity application crash. The overflow can only be triggered when a caller explicitly passes an overly long, untrusted original-filename string through the libarchive API - a condition the CVE itself characterizes as marginally plausible, since this field is not derived from archived input data. No active exploitation has been confirmed, and the official CVSS score of 2.5 (Low) with AV:L/AC:H/UI:R accurately reflects the constrained, non-default exploitation path.
Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.
Kernel memory corruption in Samsung Exynos DRM HDR driver affects mobile devices powered by Exynos 1280, 2200, and 1380 SoCs. A heap-based buffer overflow (CWE-122) in the DPU HDR processing path - caused by missing buffer size validation - allows a local low-privileged process to corrupt kernel heap memory and force a system crash. No public exploit has been identified at time of analysis, and Samsung has published a security advisory addressing this issue.
Out-of-bounds write in the camera GDC (Geometric Distortion Correction) hardware driver on Samsung Exynos 1330, 1380, 1480, and 2400 SoCs can corrupt kernel memory under specific operating conditions. The vulnerability is reachable by low-privileged processes with camera subsystem access and crosses a privilege boundary into the kernel, despite the low CVSS availability-only impact scoring. No public exploit has been identified at time of analysis, and Samsung has published a dedicated advisory.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.
Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.
Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.
Heap buffer overflow in GPAC MP4Box's `gf_node_get_field()` function (scenegraph/base_scenegraph.c) allows local low-privilege attackers to corrupt heap memory by supplying a crafted MP4 file containing malformed MPEG-4 scenegraph data. The root cause, visible in the fix commit, is misaligned field entries across multiple MPEG-4 node struct definitions in nodes_mpeg4.h - specifically `GF_ChildNodeItem` fields misassigned between struct pairs (OctreeImage/XXParticles, SolidRep/SubdivisionSurface, PointTextureV2/SBVCAnimationV2) - causing `gf_node_get_field` to compute incorrect byte offsets and write outside intended heap allocations. A public proof-of-concept exists; no active exploitation (CISA KEV) has been confirmed.
Memory corruption in davenardella snap7 up to version 1.4.3 allows a network-accessible, high-privileged attacker to corrupt memory by supplying a malformed DataLen argument to the TSnap7MicroClient::opUpload function in src/core/s7_micro_client.cpp. The affected library is used for communicating with Siemens S7 PLCs in industrial control environments, making the confidentiality, integrity, and availability of PLC upload sessions potentially compromised. A public proof-of-concept exists via a GitHub issue report, and the project maintainer has not yet responded or issued a patch.
Stack buffer overflow in alsa-lib through 1.2.16.1 allows local low-privilege attackers to crash any process consuming ALSA control-element identifiers by supplying a name= field of 64 or more characters via saved state files or command-line arguments. The off-by-one condition in __snd_ctl_ascii_elem_id_parse() (ctlparse.c:216-241) writes one byte past a 64-byte stack buffer, corrupting adjacent stack memory and causing process termination. No public exploit is identified at time of analysis; modern stack-canary mitigations further limit exploitation beyond DoS.
Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.
Stack-based buffer overflow in ArduinoCore-avr versions prior to 1.8.8 allows an attacker who can influence float or double values passed to Arduino String concatenation methods to corrupt stack memory on AVR-based Arduino boards, causing denial of service and - under specific conditions - arbitrary code execution on the microcontroller. The flaw resides in `String::concat(float)` and `String::concat(double)` in `WString.cpp`, where a fixed 20-byte stack buffer is insufficient for values near the extremes of the float or double range when processed by `dtostrf()`. A vendor-released patch is available in version 1.8.8; no public exploit has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault. Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA (Dynamic Address Assignment), the controller reports the result via the NRSPQP (Normal Response Queue Port Register). The data length field of the response descriptor, which is accessible through the NRSPQP register, indicates the number of devices remaining after DAA. Consequently, when the bus is empty, this field contains the maximum number of devices supported by the controller (8 for the Renesas I3C controller). Adjust the condition that computes the newly discovered devices bitmask to prevent an out-of-bounds when the I3C bus is empty.
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
Integer overflow in the FreeRDP client's Apple/CoreAudio audio-input (audin) backend, present in all versions before 3.31.0, allows a malicious or compromised RDP server to corrupt memory on the connecting client. The server sends an MSG_SNDIN_OPEN message carrying a crafted FramesPerPacket value that wraps the size arithmetic used by AudioQueueAllocateBuffer, producing an undersized allocation that is then written past its bounds during audio capture. Impact is bounded to the client (CVSS 5.3, all impacts Low, UI:P — the victim must initiate a connection to the hostile server); patch status is 'available from vendor' with a fix in 3.31.0, and no public exploit or CISA KEV entry was identified at time of analysis.
Opening a crafted .rdp connection file in the FreeRDP xfreerdp X11 client (versions 3.11.0 through 3.30.0) can trigger out-of-bounds heap reads and writes because the client fails to validate MonitorIds array values in xf_detect_monitors. This local, user-interaction-gated flaw requires a victim to open the malicious file and does not affect the RDP server side; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). The vendor has released a patch in FreeRDP 3.31.0, and the CVSS 6.9 rating reflects limited confidentiality and integrity impact with a high availability impact.
Heap buffer overflow in the NGINX HTTP/3 module (ngx_http_v3_module) can crash NGINX worker processes or corrupt a limited amount of heap data when NGINX Plus or NGINX Open Source serves QUIC traffic while linked against OpenSSL 3.5.0 or earlier under certain configurations. The overflow occurs while processing a TLS handshake and is non-deterministic — triggering it is largely outside the attacker's control — so the realistic outcome is opportunistic denial of service (worker restart) plus limited data corruption rather than reliable remote code execution. There is no control plane exposure (data plane only), no public exploit identified at time of analysis, and no CISA KEV listing; EPSS data was not provided.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
Rendering a crafted Lottie vector animation with Samsung's open-source rLottie library can overflow a fixed-size stack buffer during run-length-encoding of render spans, corrupting memory in the host application. The flaw affects rLottie builds at revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39 and is rated only 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) because an attacker must induce the victim application to render a malicious animation; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. An upstream fix exists in Samsung/rlottie pull request 607, which increases the span array capacity and adds explicit bounds checks.
Memory corruption in GPAC's scenegraph node management routine `gf_node_list_insert_child` (in `scenegraph/base_scenegraph.c`) can be triggered by a remote attacker delivering a crafted MPEG-4/BIFS scene file, causing a process crash (DoS). A publicly available proof-of-concept exploit (`poc_18_nstatx.zip`) is distributed via GitHub, lowering the exploitation bar. All GPAC releases up to commit f1219cde are affected; version abi-16.23 resolves the issue. No confirmed active exploitation campaign (not in CISA KEV) has been identified at time of analysis.
Stack exhaustion via unbounded recursion in GPAC's scenegraph node activation routine allows a local attacker to crash the application or corrupt memory when a malicious or malformed multimedia scene file is opened. Affected versions up to commit f1219cde lack a recursion depth guard in gf_node_activate_ex and gf_node_deactivate_ex, enabling crafted cyclic or deeply nested VRML/X3D/XMT scene graphs to exhaust the call stack. A publicly available proof-of-concept (poc_17_nstatx.zip) exists; however, no active exploitation has been confirmed and impact is limited to low integrity and availability consequences on the local system.
Heap out-of-bounds access in GPAC's URL concatenation utility (`utils/url.c`) allows a local low-privileged attacker to trigger memory corruption when the `gf_url_concatenate_ex` function processes a crafted URL that results in an empty temporary buffer. The trailing-whitespace trim loop computes `tmp[strlen(tmp)-1]` without first checking that `tmp` is non-empty, accessing heap memory at index -1. Exploitation requires local system access and user interaction; no public exploit exists and the vulnerability is not listed in CISA KEV. The fix is available in GPAC release abi-16.23.
Heap-based buffer overflow in GPAC's MPEG Video Reframer filter exposes users of versions up to commit f1219cde to memory corruption when processing a malformed MPEG video file. The vulnerable function mpgviddmx_process() in filters/reframe_mpgvid.c previously relied on gf_assert() to validate MPEG start codes without first confirming the buffer contains at least 3 bytes, enabling heap corruption on crafted input. A proof-of-concept exploit has been publicly disclosed via GitHub; no CISA KEV listing or confirmed active exploitation exists at time of analysis.
CVE-2026-75883 is an Ubuntu security update with no technical details publicly disclosed at time of analysis. The description contains only the phrase 'security update,' providing no information about the vulnerability class, affected component, or attacker capabilities. No CVSS vector, CWE, or supplementary intelligence is available to characterize impact or exploitation conditions.
Memory corruption in GNU Binutils 2.47 is triggerable locally by supplying a crafted ELF file to any Binutils tool that invokes `_bfd_elf_strtab_delref` in `bfd/elf-strtab.c`. A low-privileged local attacker can corrupt heap memory in the BFD library's ELF string table handler, potentially causing process crash, limited information disclosure, or minor data manipulation. A public proof-of-concept exists per the CVSS 4.0 E:P modifier and CVE description; no vendor patch has been released as the upstream project had not yet responded to the bug report at time of disclosure.
Out-of-bounds write in the Zephyr RTOS ITE it51xxx I2C target driver allows a malicious or compromised I2C master to corrupt embedded controller firmware memory by sending a write transaction exceeding 256 bytes while the controller operates in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() accumulated bytes into a fixed-size buffer without a pre-write bounds check, enabling overflow into the adjacent target_out_buffer and following static device data in the interrupt handler context. No software privilege on the victim controller is required; the attacker needs physical or electrical access to the I2C bus with both CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE enabled. No public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.
A stack-based buffer overflow exists in GPAC 26.07.0 within the scene-graph DOM event handler gf_sg_dom_event_bubble (src/scenegraph/dom_events.c), reachable through the MP4Box tooling when it parses a crafted scene/BT/XMT media file. Exploitation is local only — the attacker must get a file processed by an affected build — and the disclosed impact is loss of availability rather than code execution or data disclosure. Publicly available exploit code exists (a PoC archive is linked from the advisory), but EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and the SSVC decision is exploitation=poc, automatable=no, technical impact=partial, so this is a low-priority, local, denial-of-service-class memory-safety bug rather than an urgent remote threat.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
An integer-overflow flaw (CWE-190) in Apple macOS lets an attacker who already occupies a privileged on-path network position crash or otherwise deny service to the affected system. The vulnerability is fixed in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8, so every earlier build of those three branches is exposed. There is no CISA KEV listing and no identified public exploit code, and EPSS places exploitation likelihood at roughly 0.17% (6th percentile), making this a routine patch-cycle item rather than an emergency for most fleets.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
Denial of service in Apple iOS, iPadOS, and macOS results from an integer overflow (CWE-190) that a locally installed and executing application can trigger to cause unexpected system termination. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) confirms local access with low privileges, no user interaction, and impact limited to availability - there is no confidentiality or integrity loss and no remote or network-triggerable path. This is a genuinely low-priority issue despite its MEDIUM rating: EPSS is 0.20% (10th percentile), no public exploit code was identified at time of analysis, there is no CISA KEV listing, and Apple has shipped fixed versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27), leaving exposure limited to unpatched devices on which an attacker can already run code.
Connecting an attacker-controlled hardware accessory to an unpatched iPhone, iPad, or Mac can drive a memory corruption fault that terminates the system (unexpected system termination) in iOS/iPadOS before 26.7 and before 27, and in macOS Tahoe before 26.7 and macOS Golden Gate before 27. The vendor describes the root cause as insufficient input validation (CWE-20) on data supplied by the attached peripheral; the vector requires no privileges on the target device (PR:N) but does require the victim to physically attach the malicious accessory and to interact with it (UI:R), and the impact is availability-only with no confidentiality or integrity loss. Apple has released fixes (iOS/iPadOS 26.7 and 27, macOS Tahoe 26.7 and macOS Golden Gate 27), the vendor score is 5.5, EPSS is 0.15% (5th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
A local out-of-bounds read in Apple macOS lets an already-installed and running application trigger an unexpected system termination, resulting in denial of service on the host it is running on. Exploitation requires local code execution as a low-privileged app (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) - there is no network vector, and the impact is confined to availability, with no data exposure or privilege escalation. The flaw affects pre-fix builds of macOS Sequoia (<15.8), macOS Tahoe (<26.7) and macOS Golden Gate (<27), and no public exploit has been identified at time of analysis; the independently assessed exploitation status is 'no public exploit identified at time of analysis' and EPSS is only 0.19% (9th percentile), consistent with a low-priority defensive item. Apple has released fixed versions, so remediation is a straightforward OS update.
An out-of-bounds write in Apple's operating systems - iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27 - allows a remote, unauthenticated attacker to crash the application that processes a maliciously crafted file, with the flaw addressed through improved bounds checking. Successful exploitation requires the victim to open or process the attacker-supplied file (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), and the realized impact is limited to termination of the processing app with no confidentiality or integrity effect and no system-wide crash. Vendor patches are available from Apple across all affected platforms, the EPSS score is low at 0.20% (10th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite the memory-corruption class.
Heap-based buffer overflow in Apple's operating system platforms - iOS and iPadOS (before 26.7 and 27), macOS Golden Gate (before 27), visionOS (before 27), and watchOS (before 27) - allows a remote attacker to crash the processing application by delivering a maliciously crafted file that the victim opens. Successful exploitation requires user interaction (CVSS UI:R) and leads only to unexpected termination of the affected app; there is no confidentiality or integrity impact and no described code execution or system-wide compromise, which is why our independent assessment lowers the availability impact to A:L rather than the vendor's A:H. No public exploit code has been identified at time of analysis and exploitation is not confirmed actively exploited (CISA KEV); EPSS is 0.18% (8th percentile), indicating a low predicted likelihood of exploitation. Vendor patches are available.
Opening a maliciously crafted file on an unpatched Apple device can crash the parsing process or disclose its memory contents, an out-of-bounds read that Apple addressed with improved input validation and fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), exploitation is unauthenticated from the network but hinges entirely on user interaction - the victim must open the crafted file - and impact is confined to the vulnerable process as a limited read-only disclosure or denial of service, with no code execution or data modification. EPSS is 0.18% (7th percentile), no public exploit has been identified at time of analysis, and vendor patches are already available, making this a low-priority issue despite the network attack vector.
An out-of-bounds read in Apple's font-processing code can crash (terminate) an application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS when it parses a maliciously crafted font file, but it cannot be used to execute code, escalate privileges, or steal data. The issue affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7 and Golden Gate 27, and tvOS, visionOS and watchOS before 27, and it is fixed in those listed releases; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, score 4.3) confirms that unauthenticated remote attackers can only succeed if a victim is induced to open or render the crafted font (user interaction required), and exploitation yields availability loss only. No public exploit code has been identified at time of analysis and the EPSS score is 0.21% (11th percentile), so real-world exploitation is unlikely; this is a genuinely low-priority issue despite the network attack vector.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
Unexpected system termination in Apple macOS is caused by an out-of-bounds read in the SMB client that is triggered when a user initiates a connection to a malicious or spoofed SMB server. The affected versions are macOS releases before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is a low 0.17% (6th percentile). An attacker who controls or spoofs the SMB endpoint the victim reaches can force a crash, with no privilege escalation, code execution, or data disclosure assessed.
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.
Mounting a maliciously crafted disk image or removable-media volume on an unpatched Apple device triggers a heap buffer overflow in the operating system's volume-parsing code, causing unexpected system termination (denial of service). Affected builds are iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate 27. Exploitation is gated by mandatory user interaction - the crafted volume must be attached and mounted by the victim - and the assessed impact is limited to system termination with no code execution, data disclosure, or persistence; EPSS is only 0.19% (9th percentile) and no public exploit code has been identified, though Apple has released patched versions and CISA KEV does not list this CVE. Real-world risk is LOW-to-MODERATE despite the 6.5 (Medium) CVSS, since the practical attack path is local/physical delivery rather than network reach.
Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Improper bounds checking during image processing on unpatched Apple operating systems lets a crafted image crash the application that renders it, affecting iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is scored 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), meaning an unauthenticated remote attacker can trigger it only if the victim opens or renders the malicious image, and the outcome is limited to unexpected application termination rather than code execution, data disclosure, or integrity loss. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is a low 0.21% (12th percentile), so this is a low-to-moderate priority issue rather than an emergency.
Out-of-bounds memory corruption in Apple's 3D scene processing pipeline lets a maliciously crafted scene file terminate the application that renders it across iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds released before the fixed versions. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (score 4.3): no authentication or elevated privileges are required, but the attacker cannot succeed without the victim opening or rendering the supplied scene, and the resulting impact is confined to application termination with no confidentiality, integrity, or demonstrated code-execution effect. No public exploit identified at time of analysis, EPSS is 0.18% (8th percentile), and Apple has shipped patches for every affected platform, making this a low-priority denial-of-service defect rather than a code-execution emergency.
An out-of-bounds write in the Apple macOS kernel allows a locally running application to corrupt kernel memory, potentially causing unexpected system termination or arbitrary kernel memory writes. The flaw affects macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, with a CVSS base score of 6.1 (AV:L/AC:L/PR:L/UI:N) reflecting the requirement for local code execution with attacker-controlled privileges. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.16%, 6th percentile), suggesting targeted rather than opportunistic exploitation; CISA KEV does not list this CVE.
An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.
Unexpected system termination can be triggered on Apple macOS when a locally running app - including one executed by a standard, non-administrative user - exercises a memory-handling defect in the operating system, causing the machine to crash. Affected builds are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27; the issue is a local, availability-only denial of service (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:N/A:H) with no demonstrated confidentiality or integrity impact and no privilege escalation. Publicly available exploit code exists (a public gist is referenced) but there is no CISA KEV listing, and exploitation is confirmed only as a proof-of-concept rather than confirmed actively exploited activity; EPSS is 0.17% (6th percentile), reinforcing that mass exploitation is unlikely.
An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.
An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
Mounting a maliciously crafted exFAT volume on an unpatched macOS system (versions before Golden Gate 27) can trigger an out-of-bounds read in the kernel, leading to kernel memory disclosure or unexpected system termination. Exploitation requires user interaction to mount the attacker-supplied volume, and no public exploit code or active exploitation has been identified at time of analysis (EPSS 0.16%).
Processing a maliciously crafted image on unpatched Apple devices can trigger a memory-corruption fault that crashes the affected process, producing a local denial-of-service (CVSS 3.1 base 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected platforms are iOS and iPadOS before 18.7.10 and macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Golden Gate 27; the attacker cannot trigger the flaw remotely and must get the victim to open or auto-render the crafted image. All signals point to a low-priority issue: EPSS is 0.20% (10th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are already available.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.
Mounting a crafted disk image on an affected Mac can crash the system: Apple macOS Sequoia, Tahoe and Golden Gate contain a buffer overflow in the disk-image handling path that is triggered when a user opens a malicious image, requiring no credentials. Apple has shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. EPSS is low (0.19%, 8th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical concern is availability loss (forced termination, potential unsaved-work loss) rather than code execution.
Kernel memory corruption in Apple macOS lets a locally running application crash the operating system or corrupt kernel memory, with the potential for further kernel-level compromise. The flaw is a memory-bounds handling defect (CWE-119) present in macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and is fixed in those releases per Apple's advisories. Exploitation requires the ability to execute code as a local user (CVSS AV:L/PR:L), EPSS is low at 0.19% (9th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
A use-after-free and double-free race in Zephyr's TLS socket session cache lets a malicious or compromised TLS peer corrupt the mbedTLS heap and crash an affected device. The flaw is reachable only by applications that explicitly enable the TLS_SESSION_CACHE socket option (off by default) and run concurrent TLS client connections from multiple threads, since the process-global client_cache defaults to a single shared slot. A vendor fix exists in commit 7f9d8ee (shipping in Zephyr 4.4.2 per the EUVD version range), and no public exploit code or active exploitation has been identified.
Stack-based buffer overflow in MikroTik RouterOS's mtget binary TFTP RRQ builder allows any authenticated user, including those with only read-only group membership, to crash the mtget worker process by issuing a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow involves an unbounded rep movsb instruction that overwrites saved registers at a deterministic stack offset, causing a reproducible process crash without requiring network connectivity to an actual TFTP server. No public exploit code has been identified at time of analysis, and vendor patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).
GNU Binutils 2.47 contains a heap out-of-bounds write in the ELF `.eh_frame` handler `_bfd_elf_write_section_eh_frame`, triggered when a malformed object file causes the library to compute a negative size that is then passed to a `memmove` during section rewriting. The attack is local: an attacker must get a crafted ELF file processed by a BFD-based tool (such as `ld`, `objcopy`, or `strip`) on the target system, after which the process can corrupt heap memory and crash. Exploit code is publicly available, though the CVSS 4.0 base score is only 0.9 because the required privileges, user interaction, and limited observed impact keep real-world severity low; there is no CISA KEV listing, and upstream has not responded to the bug report.
A heap out-of-bounds read/write leading to a buffer overflow exists in the GNU linker (ld), part of GNU Binutils 2.47, inside the elf_x86_64_relocate_section() function of bfd/elf64-x86-64.c, triggered when the linker processes a malformed x86-64 relocation entry whose roff argument is not validated. Exploitation is local — an attacker must supply a crafted ELF object file to a link operation — and yields only limited confidentiality, integrity and availability impact (CVSS 4.0 base 1.9), but publicly available exploit code exists and a heap OOB write/SEGV proof-of-concept has been published. The flaw is fixed in Binutils 2.48 via upstream commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b; it is not listed in CISA KEV, so active in-the-wild exploitation is not confirmed.
Local denial of service in SSSD's PAM responder occurs when a local process with access to the responder's UNIX socket negotiates legacy PAM protocol v1 and sends an empty or truncated request body. The out-of-bounds read in pam_parse_in_data() can terminate or restart the responder, causing availability loss for local authentication. This is a low-severity issue (CVSS 4.0, EPSS 0.12%, 2nd percentile) with no public exploit identified at time of analysis and no confirmed active exploitation in the provided data; exploitation requires a local foothold that can reach the socket and explicitly negotiate protocol v1.
GNU Binutils 2.47 contains a heap buffer overflow in cache_bwrite (bfd/cache.c) that is reachable when the GNU linker 'ld' processes a malformed ELF object file with the --gc-sections and -w options. Exploitation is local and low-impact per the vendor vector (CVSS 4.0 base 1.9, AV:L/PR:L, C/I/A:L), but publicly available exploit code exists, confirming the overflow is reproducible against a released version. The issue was reported upstream via Sourceware Bugzilla bug 34442 and, per the vulnerability record, the project has not responded, so no fixed release has been identified.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Memory corruption in marcobambini Gravity scripting language versions 0.9.0 through 0.9.7 allows remote attackers with low-privilege access to trigger undefined behavior via crafted JSON input processed by gravity_json.c, potentially causing a crash or exploitable memory state in embedding applications. The root cause is a two-pass JSON parser design flaw where u.object.values is used as a size counter during the first pass but incremented with pointer arithmetic on a null pointer - undefined behavior per the C standard, confirmed to trap under -fsanitize=undefined. A publicly available proof-of-concept exists as GitHub issue #448; no active exploitation has been identified in the wild.
Stack-based buffer overflow in Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* allows an authenticated remote attacker to trigger a denial-of-service condition by sending a specially crafted network request. The overflow (CWE-121) corrupts stack memory, crashing the device firmware without evidence of code execution capability. No public exploit or KEV listing exists; JPCERT/CC published the advisory coordinated with Contec.
Out-of-bounds write in CONPROSYS nano Series Remote I/O Coupler Units from Contec Co., Ltd. enables remote attackers with low-privilege network access to crash affected industrial automation devices by sending specially crafted network requests. Affected hardware includes server-type couplers (CPSN-MCB271), EtherNet/IP adapter variants (CPSN-EOB471EI), and software PLC-type units (CPSN-PCB271-S1-041), placing operational technology environments at risk of physical process disruption from device-level DoS. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Buffer overflow in the Panasonic Industry USB Driver for MINAS A5/A6 servo drives allows a local low-privileged attacker to crash Windows on machines running PanaTerm or RTEX LogReader software. The root cause is classic unchecked buffer copy (CWE-120) in the driver component bundled with the affected Panasonic software titles. Impact is limited to availability - a successful exploitation stops the Windows OS, but no confidentiality or integrity impact has been identified.
Memory corruption in GPAC's BIFS Text (BT) scene parser allows a remote attacker to crash the MP4Box process or corrupt process memory by supplying a crafted BT scene file. The primary defect in `gf_bt_parse_bifs_command()` (loader_bt.c:2812) is a format-string mismatch: the variable `str` is embedded in the format literal passed to `gf_bt_report` rather than supplied as a variadic argument, causing the `%s` specifier to dereference an uncontrolled stack or heap value. The patch (commit afca1f1181668d85941d51ed1adf647807d5d975, release abi-16.23) bundles several related fixes across the codebase; a public proof-of-concept exists but no confirmed active exploitation has been recorded.
Heap-based buffer overflow in jhead up to 3.3 allows a local attacker with low privileges to corrupt process memory by supplying a crafted WebP image with malformed GPS EXIF tags (TAG_GPS_LAT or TAG_GPS_LONG) to the ProcessGpsInfo() function in gpsinfo.c. A proof-of-concept has been publicly released via GitHub, and the project maintainer has not responded to the responsible disclosure report. No vendor-released patch is available at time of analysis.
Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.
Heap buffer overflow in SWF (Shockwave Flash) decompression depth handling affects a file analysis engine - most likely ClamAV, based on the 'detect/file_data' module path and Ubuntu as the reporting vendor. An attacker can supply a specially crafted SWF file that, when scanned, triggers out-of-bounds writes on the heap during recursive or depth-tracked decompression, potentially leading to process crash or arbitrary code execution within the scanning daemon. No patch version, CVSS vector, or CWE is included in the input; no public exploit is identified at time of analysis.
Out-of-bounds write in the Samsung Exynos camera driver error-handling path causes memory corruption on eight Exynos mobile processor variants. Exploitation requires local access with low privileges and high attack complexity to reach the faulty error path, with a changed scope producing only low availability impact - consistent with a crash or transient DoS rather than code execution. No public exploit code exists and the vendor has published a security update via the Samsung Semiconductor support portal.
Unchecked strcpy() of the GZIP original-filename header field in libarchive 3.8.x causes a heap-based buffer overflow (CWE-122) in the gzip compression writer, with impact limited to a low-severity application crash. The overflow can only be triggered when a caller explicitly passes an overly long, untrusted original-filename string through the libarchive API - a condition the CVE itself characterizes as marginally plausible, since this field is not derived from archived input data. No active exploitation has been confirmed, and the official CVSS score of 2.5 (Low) with AV:L/AC:H/UI:R accurately reflects the constrained, non-default exploitation path.
Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.
Kernel memory corruption in Samsung Exynos DRM HDR driver affects mobile devices powered by Exynos 1280, 2200, and 1380 SoCs. A heap-based buffer overflow (CWE-122) in the DPU HDR processing path - caused by missing buffer size validation - allows a local low-privileged process to corrupt kernel heap memory and force a system crash. No public exploit has been identified at time of analysis, and Samsung has published a security advisory addressing this issue.
Out-of-bounds write in the camera GDC (Geometric Distortion Correction) hardware driver on Samsung Exynos 1330, 1380, 1480, and 2400 SoCs can corrupt kernel memory under specific operating conditions. The vulnerability is reachable by low-privileged processes with camera subsystem access and crosses a privilege boundary into the kernel, despite the low CVSS availability-only impact scoring. No public exploit has been identified at time of analysis, and Samsung has published a dedicated advisory.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.
Out-of-bounds memory access in Samsung's CustOS Driver on Exynos 1580 processors exposes a local low-privileged attacker to cross-TEE-boundary memory read and write primitives. The fault is triggered by submitting an oversized shared memory allocation request to the custos_iwc inter-world communication device, which the driver services without adequate bounds validation, potentially leaking secure-world data or corrupting CustOS runtime state. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis.
Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.
Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.
Heap buffer overflow in GPAC MP4Box's `gf_node_get_field()` function (scenegraph/base_scenegraph.c) allows local low-privilege attackers to corrupt heap memory by supplying a crafted MP4 file containing malformed MPEG-4 scenegraph data. The root cause, visible in the fix commit, is misaligned field entries across multiple MPEG-4 node struct definitions in nodes_mpeg4.h - specifically `GF_ChildNodeItem` fields misassigned between struct pairs (OctreeImage/XXParticles, SolidRep/SubdivisionSurface, PointTextureV2/SBVCAnimationV2) - causing `gf_node_get_field` to compute incorrect byte offsets and write outside intended heap allocations. A public proof-of-concept exists; no active exploitation (CISA KEV) has been confirmed.
Memory corruption in davenardella snap7 up to version 1.4.3 allows a network-accessible, high-privileged attacker to corrupt memory by supplying a malformed DataLen argument to the TSnap7MicroClient::opUpload function in src/core/s7_micro_client.cpp. The affected library is used for communicating with Siemens S7 PLCs in industrial control environments, making the confidentiality, integrity, and availability of PLC upload sessions potentially compromised. A public proof-of-concept exists via a GitHub issue report, and the project maintainer has not yet responded or issued a patch.
Stack buffer overflow in alsa-lib through 1.2.16.1 allows local low-privilege attackers to crash any process consuming ALSA control-element identifiers by supplying a name= field of 64 or more characters via saved state files or command-line arguments. The off-by-one condition in __snd_ctl_ascii_elem_id_parse() (ctlparse.c:216-241) writes one byte past a 64-byte stack buffer, corrupting adjacent stack memory and causing process termination. No public exploit is identified at time of analysis; modern stack-canary mitigations further limit exploitation beyond DoS.
Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.
Stack-based buffer overflow in ArduinoCore-avr versions prior to 1.8.8 allows an attacker who can influence float or double values passed to Arduino String concatenation methods to corrupt stack memory on AVR-based Arduino boards, causing denial of service and - under specific conditions - arbitrary code execution on the microcontroller. The flaw resides in `String::concat(float)` and `String::concat(double)` in `WString.cpp`, where a fixed 20-byte stack buffer is insufficient for values near the extremes of the float or double range when processed by `dtostrf()`. A vendor-released patch is available in version 1.8.8; no public exploit has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault. Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA (Dynamic Address Assignment), the controller reports the result via the NRSPQP (Normal Response Queue Port Register). The data length field of the response descriptor, which is accessible through the NRSPQP register, indicates the number of devices remaining after DAA. Consequently, when the bus is empty, this field contains the maximum number of devices supported by the controller (8 for the Renesas I3C controller). Adjust the condition that computes the newly discovered devices bitmask to prevent an out-of-bounds when the I3C bus is empty.