Buffer Overflow
Monthly
In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2. This series fixes an off-by-one out-of-bounds read in ucs2_strnlen(). The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation. This patch (of 2): ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit. Test the length before dereferencing to prevent an off-by-one out-of-bounds read.
In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() pci_write_legacy_io() loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if (count != 1 && count != 2 && count != 4) return -EINVAL; return pci_legacy_write(bus, off, *(u32 *)buf, count); kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1), so a 1-byte write to the legacy_io sysfs file allocates 2 bytes and the unconditional u32 load reads up to 2 bytes past the end of the allocation, which KASAN reports as a slab-out-of-bounds read. Similarly, a 2-byte write overreads by 1 byte. Thus, read only the number of bytes requested using get_unaligned_le16() and get_unaligned_le32() for the 2 and 4 byte cases, interpreting the buffer as little-endian to match the byte ordering of PCI I/O port space. The PowerPC implementation previously compensated for the generic code's native-endian 32-bit load by shifting the value into place for the 1 and 2 byte cases. The shifts were only correct on big-endian kernels. On little-endian PowerPC (POWER8 and later), they extracted the wrong bytes, so a 1-byte write wrote an out-of-bounds byte instead of the requested value. On big-endian, the native load also caused out_le16() and out_le32() to reverse the user's bytes on the wire for 2 and 4 byte writes. The little-endian helpers resolve both issues, so the shifts are removed. No changes are needed for the Alpha platform. The legacy_io file is root-only and exists only on Alpha and PowerPC, the two architectures that define HAVE_PCI_LEGACY.
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback_store() Patch series "zram: fix stale scan bounds after reinitialization". Both writeback_store() and read_block_state() derive their table scan bounds from zram->disksize before acquiring dev_lock. If the device is reset and reinitialized with a smaller disksize between that read and lock acquisition, the bound can describe the old table while the scan operates on the new one. This can lead to out-of-bounds slot accesses. Move both bound calculations under dev_lock so each bound remains consistent with the table throughout its scan. Keep the fixes separate because the affected interfaces originate from different commits and can be backported independently. This patch (of 2): writeback_store() calculates the table scan bounds before taking dev_lock. A reset followed by reconfiguration with a smaller disksize can therefore replace zram->table while writeback_store() is waiting for the lock. Once it acquires the lock, it sees an initialized device but scans the new table using the old upper bound, resulting in an out-of-bounds access. Calculate the number of pages while holding dev_lock so the scan bound matches the table protected by the lock.
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on the wire and decodes cleanly into a valid uint32, but it is not a valid timespec64: tv_nsec must be less than NSEC_PER_SEC. Nothing in the setattr path clamps it. notify_change() runs the time through timestamp_truncate(), which does not reduce tv_nsec below NSEC_PER_SEC when the filesystem supports nanosecond granularity (s_time_gran == 1), and the inode atime/mtime setters store it verbatim (only ctime is normalized, via inode_set_ctime_to_ts()). The un-normalized value then corrupts on-disk metadata: ext4's ext4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which overflows the 32-bit extra field and clobbers the seconds-epoch bits, so the stored seconds (and thus the year) are wrong on read-back. XFS with bigtime mis-stores the timestamp for the same reason. Validate the client-supplied atime/mtime in the proc handlers and return NFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL for SETATTR and describes it as the error for a value the server 'can not store ... in its own representation'; the client maps it to EINVAL. Checking in the proc handlers, rather than in nfsd_setattr(), keeps the rejection in front of object creation. The create operations create the object before nfsd_create_setattr() runs, so a late failure would leave the new object behind and turn a non-idempotent request into a namespace change that reports failure. The check is therefore done up front, for the create operations before the object is created. tv_nsec is a long, so the comparison casts it to unsigned long (the same width) rather than to u32, matching timespec64_valid(). A u32 cast would truncate on 64-bit; the unsigned long cast also rejects a value that became negative when an out-of-range u32 wire nseconds was assigned to a 32-bit long. Only client-supplied times are checked: SET_TO_SERVER_TIME requests carry no client value. The sattrguard3 ctime is deliberately left alone: an out-of-range guard simply never matches the object's ctime and yields NFS3ERR_NOT_SYNC via the existing guardtime comparison, which is the protocol-correct outcome rather than rejecting the request.
In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected values to avoid this.
In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte supplied by the device in its REPORT_EE_DATA reply -- clamped only to the caller's read() count: ret = resp->raw_data[2]; if (ret > s) ret = s; if (copy_to_user(u, resp->raw_data+3, ret)) It never checks resp->raw_size, the number of bytes picolcd_raw_event() actually copied into the 64-byte raw_data[] of the kmalloc'd struct picolcd_pending. A device (or a spoofed picoLCD) returning a length byte of 0xff, read with a count >= 255, makes copy_to_user() read past raw_data[] into adjacent slab memory and return it to userspace through the debugfs "eeprom" file: BUG: KASAN: slab-out-of-bounds in _copy_to_user Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd] The debug-dump path in the same file already validates the device length byte against the received size before trusting it; this read does not. The file is created S_IRUSR (root-only) and a crafted device is needed, so it is neither unprivileged- nor remotely-triggerable. Clamp the copy length to resp->raw_size - 3 (the payload actually received, minus the 3-byte header), floored at 0 for short replies.
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() rocket_job_push() allocates a temporary array to hold all input and output GEM object pointers: bos = kvmalloc_array(job->in_bo_count + job->out_bo_count, sizeof(void *), GFP_KERNEL); memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *)); memcpy(&bos[job->in_bo_count], job->out_bos, ...); Two bugs exist: 1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference. 2. Integer overflow: in_bo_count and out_bo_count are both u32, set directly from userspace-supplied in_bo_handle_count and out_bo_handle_count with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmalloc_array() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array. Fix by using check_add_overflow() to detect count overflow before the allocation, and adding a NULL check on the allocation result.
In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build_constructor_string() Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf().
In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechdrs, section sizes and offsets are validated, unless the section type is SHT_NULL or SHT_NOBITS. Later, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring that their types are SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory when dereferenced in elf_validity_cache_secstrings or elf_validity_cache_strtab. Validate that both string section headers are of type SHT_STRTAB before caching them.
In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() sk_store() and kek_store() strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if (buf[length - 1] == '\n') length--; bioscfg_drv.spm_data.signing_key = kmemdup(buf, length, GFP_KERNEL); but then pass the original "count" (not "length") as the copy size to hp_wmi_perform_query(), which memcpy()s that many bytes out of the "length"-sized allocation, reading one byte past it whenever the write ends in a newline, the normal case for a shell "echo" into sysfs. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg] Read of size 28 at addr ffff88813c8e2b80 by task python3/16022 ... sk_store+0xa7/0x240 [hp_bioscfg] kernfs_fop_write_iter+0x3e1/0x5d0 ... The buggy address is located 0 bytes inside of allocated 27-byte region [ffff88813c8e2b80, ffff88813c8e2b9b) Reproduced identically for kek_store, and at multiple write sizes (28, 57, 201 bytes), each time reading exactly one byte past a kmemdup() allocation one byte smaller than the write. Fix by passing "length" instead of "count" to hp_wmi_perform_query() in both functions.
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire_comm_receiver_handler() forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if (!urb->status) { if (rt->receiver_buffer[0] == 0x10) /* midi in event */ if (midi_rt) midi_rt->in_received(midi_rt, rt->receiver_buffer + 2, rt->receiver_buffer[1]); } receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the device chooses, so a device that answers with 0x10 and a length of 0xFF makes snd_rawmidi_receive() read 255 bytes starting two bytes into a 64-byte object. The bytes past the buffer are handed to userspace through the rawmidi read path. urb->actual_length is not consulted either, so a short transfer leaves both the type byte and the length byte at their previous values and the handler acts on stale data. The receiver URB is submitted from usb6fire_comm_init() at probe, so the read happens on plug with no user action; forwarding to userspace also needs a MIDI input substream open, since usb6fire_midi_in_received() only calls snd_rawmidi_receive() when rt->in is set. KASAN on 7.2.0-rc5 (arm64), single packet from an emulated device: BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive Read of size 255 at addr ffff000009f64682 by task bash/183 __asan_memcpy snd_rawmidi_receive usb6fire_midi_in_received [snd_usb_6fire] usb6fire_comm_receiver_handler [snd_usb_6fire] Allocated by task 11: usb6fire_comm_init [snd_usb_6fire] usb6fire_chip_probe [snd_usb_6fire] The buggy address is located 2 bytes inside of allocated 64-byte region [ffff000009f64680, ffff000009f646c0) Reject the event when the length exceeds the bytes that follow the header, and require the transfer to have delivered the header plus that many bytes. The receiver URB is submitted with a 64-byte transfer_buffer_length, so a genuine device cannot deliver an event longer than those 62 bytes and nothing valid is dropped. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media seg_num against the cache device size seg_num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cache_seg_init() -> cache_dev_zero_range() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero seg_num makes the segment allocations ZERO_SIZE_PTR. Reject a seg_num that is zero, larger than the device can hold, or larger than PCACHE_CACHE_SEGS_MAX before it is used.
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max_payload_len svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size (SVC_I3C_FIFO_SIZE), not by the slot size. slot->data points into the IBI pool, which i3c_generic_ibi_alloc_pool() sizes at max_payload_len per slot. svc_i3c_master_request_ibi() only rejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can request a smaller one. mctp-i3c requests 1. Each readsb() then copies the controller RXCOUNT bytes (up to 31) with no check against the slot size. A device that sends more bytes than the slot holds writes past slot->data, an out-of-bounds write into the IBI pool. Bound the loop by dev->ibi->max_payload_len and clamp each read to the space left in the slot, the same way dw-i3c does. A device can still send more than the requested payload. Flush the leftover bytes from the RX FIFO so they do not leak into the next transfer.
Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Heap buffer overflow in Suricata's rule parser allows a local attacker with write access to rule files to crash the Suricata process during signature loading by supplying a crafted rule containing mixed-case frame keywords. Affected versions are all releases prior to 7.0.16 and 8.0.5. Exploitation is constrained to rule-load time rather than live traffic inspection, limiting impact to availability disruption of the IDS/IPS engine itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.
Type confusion in the Sierra Wireless HL78xx GNSS driver within Zephyr RTOS (4.4.0-4.4.1) allows an adjacent, unauthenticated attacker with GNSS signal-spoofing capability to drive the kernel-side NMEA parser into writing satellite data through a wild/garbage pointer, most likely crashing the device. The root defect is a struct member ordering invariant violation: the generic NMEA0183 match helper casts user_data directly to struct gnss_nmea0183_match_data, but hl78xx_gnss_data placed match_data as the second member (after const struct device), causing GGA/RMC callbacks to write fix data at wrong offsets and the GSV satellite callback to dereference a pointer constructed from non-pointer bytes. No public exploit exists; a vendor-released patch is available in Zephyr 4.4.2.
Buffer overflow in Bosch Sensortec COINES SDK versions 2.0 through 2.11 allows a malicious or compromised sensor evaluation board, connected to a host machine via USB or BLE, to overflow the host application's heap or stack by streaming an excessive volume of sensor samples. The root cause is that `coines_read_stream_sensor_data()` unconditionally performs a `memcpy` of the full ring buffer content without verifying whether the caller-provided destination buffer can accommodate it, because the internal `comm_intf_process_stream_response()` silently discards the requested `number_of_samples` bound. No public exploit has been identified at time of analysis, but successful exploitation could yield arbitrary code execution on the host developer machine.
Stack-based buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by submitting a SetUser SOAP request containing an excessive number of User XML elements, overwriting stack control state. Impact is limited to denial of service of the camera's ONVIF management interface, with no confidentiality or integrity compromise confirmed. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the GeoVision GV-LPC2011/LPC2211 V1.13 ONVIF CreateUsers handler allows an authenticated administrator to crash the ONVIF worker process by submitting a crafted SOAP request containing repeated User XML elements. The vulnerability overwrites stack control state, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector (PR:H, A:H only) constrains real-world impact to availability loss by credentialed administrators.
Stack-based buffer overflow in the GeoVision GV-LPC2211 V1.13 ONVIF service allows an authenticated administrator to crash the ONVIF worker by submitting a DeleteUsers SOAP request containing an unbounded number of Username elements. The overflow exhausts the stack array allocated for the username list, terminating the ONVIF worker process. Impact is limited to availability - the CVSS vector confirms no confidentiality or integrity compromise (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the ONVIF SetUser password handler of GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by supplying an excessively long password string. The sole confirmed impact is availability loss to the ONVIF service - no confidentiality or integrity impact is present per the CVSS vector (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrator-triggered stack buffer overflow in the GeoVision GV-LPC2211/LPC2011 V1.13 ONVIF service causes a crash of the ONVIF worker process. When an admin-authenticated user submits an oversized username or password value through the ONVIF CreateUsers operation, the device copies the value into a fixed-size stack buffer without bounds checking, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stack buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows any authenticated, low-privilege user to remotely crash the SSVR service by sending crafted fragmented SSVR protocol data. Both the GV-LPC2011 and GV-LPC2211 models share the affected codebase per CPE data. Impact is limited to availability loss - no code execution or data disclosure has been demonstrated, and no public exploit code has been identified at time of analysis.
Out-of-bounds write in libsthmbc.so affects Samsung Mobile devices running One UI prior to version 8.5, allowing local low-privilege attackers to corrupt memory beyond allocated buffer boundaries. The CVSS 4.0 vector assigns high confidentiality impact (VC:H), indicating the write primitive can be leveraged to read or expose sensitive adjacent memory content. No public exploit has been identified at time of analysis, and Samsung has shipped a fix in the One UI 8.5 security update.
Out-of-bounds write in libsavscmn.so, a shared library component of Samsung One UI, enables local attackers holding low-level user privileges to execute arbitrary code on affected devices. All Samsung devices running One UI prior to version 8.5 are in scope, with the fix delivered in the September 2026 One UI 8.5 security update as documented in Samsung Mobile's bulletin. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows a local low-privileged attacker to corrupt memory beyond allocated buffer boundaries, resulting in high confidentiality impact and minor integrity and availability effects. The CVSS 4.0 vector (AV:L/PR:L/UI:N/VC:H) confirms local access with low privileges is sufficient, with no user interaction required after the attacker establishes presence. No public exploit or active exploitation has been identified at time of analysis; Samsung Mobile released a patch in September 2026.
Out-of-bounds memory write in wpa_supplicant on Samsung Mobile Devices (Android 14 through 17) enables an adjacent unauthenticated attacker to corrupt process memory, with the CVSS 4.0 vector confirming potential high-confidentiality impact - likely exposure of Wi-Fi credentials or session keying material held in the wpa_supplicant process. Samsung resolved this in the SMR Sep-2026 Release 1 patch for all four affected Android generations. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stack-based buffer overflow in Samsung's PROCA (Process Authenticator) TrustZone trustlet allows a local privileged attacker to write out-of-bounds memory, resulting in high-confidentiality impact against affected Samsung Mobile Devices running Android 14 through 17. The flaw is patched in SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified; the CVSS 4.0 score of 5.6 reflects the significant exploitation barriers - local access, high privileges, high complexity, and specific prerequisite conditions all required simultaneously.
Out-of-bounds write in Samsung's libcodec2secevrcdec.so codec library exposes Samsung Mobile Devices running Android 14 through 17 to local memory corruption by low-privileged attackers. The flaw resides in a proprietary secure EVR codec decoder and was addressed in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in the Samsung-proprietary libsaviextractor.so library allows a local low-privileged attacker to corrupt memory on affected Samsung devices running Android 14 through 17. Exploitation requires code execution on the device with at minimum a standard user account, limiting the attack surface to malicious apps or post-compromise scenarios. Samsung has addressed the issue in SMR Sep-2026 Release 1; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle processing library allows local attackers to corrupt memory by exploiting improper input validation when removing style tags from subtitle content. Affected devices run Android 14 through 17 and are fixed in SMR Sep-2026 Release 1, disclosed through Samsung's monthly security bulletin. No public exploit identified at time of analysis, though the integrity impact is rated high (VI:H in CVSS 4.0), suggesting realistic potential for privilege escalation or code execution if chained with further exploitation.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle parsing library affects Samsung Mobile Devices running Android 14 through 17, exploitable by a local attacker who induces the device owner to open or play media containing a maliciously crafted subtitle track. The flaw carries a high integrity impact rating consistent with a memory-corruption primitive capable of enabling code execution within the media processing context, patched in the SMR Sep-2026 Release 1 monthly security update. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read via integer overflow in the HarmonyOS graphics module exposes affected devices to a denial-of-service condition. Exploitation targets HarmonyOS 6.1.0 and, per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), requires no authentication or user interaction - suggesting a network-facing graphics processing pathway is reachable without privilege. The sole confirmed impact is availability (A:L), consistent with a crash or partial service disruption in the graphics subsystem; no confidentiality or integrity impact is reported. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.
Out-of-bounds read in stb_truetype's stbtt_GetGlyphShape function enables denial of service against any application that parses attacker-supplied TrueType font files using the nothings/stb library at commit 31c1ad3. The affected function reads glyph outline data from a crafted TTF without sufficient bounds validation, causing an abnormal read that crashes the host application. No public exploit code or CISA KEV listing was identified at time of analysis; CVSS 4.3 with UI:R reflects the realistic, user-triggered exposure.
Out-of-bounds memory read in the stb library's stbsp_vsnprintf function (stb_sprintf.h) at commit 31c1ad3 enables a denial-of-service condition when a consuming application passes attacker-controlled input to the function. The nothings/stb project is Sean Barrett's widely-vendored, public-domain, single-file C library suite embedded across game engines, imaging tools, and embedded systems. No public exploit code and no CISA KEV listing exist at time of analysis; the local attack vector and high attack complexity in the CVSS vector further limit practical exploitability.
Out-of-bounds read in GPAC v26.07.0's HTTP download subsystem (gf_dm_data_received in downloader.c) enables remote denial of service when a victim user processes a crafted HTTP response containing a malformed or pathologically large chunk-size value. The upstream fix commit confirms two root causes: absence of an upper-bound cap on parsed chunk sizes and an unchecked integer overflow in the nbBytes + hdr_size computation that causes accounting to wrap around before the out-of-bounds read occurs. Impact is limited to application crash with no confidentiality or integrity consequences; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. No public exploit has been identified at time of analysis, and CVSS UI:R confirms that exploitation requires a user to initiate a connection to an attacker-controlled media source.
Out-of-bounds read in DPDK's lib/vhost virtio-net control-queue handler allows a local low-privileged attacker - such as a guest VM user with access to the virtio-net control virtqueue - to trigger an unchecked read of command_data, crashing the host-side DPDK vhost process. Affected deployments include NFV platforms, cloud hypervisors, and telco packet-processing stacks that use DPDK vhost-user for guest I/O. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 3.3 reflects local access and limited availability impact.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.
Heap-based buffer overflow in Cesanta mJS up to version 1.26 allows unauthenticated remote attackers to achieve partial memory corruption by supplying crafted JavaScript input that triggers the `skip_spaces_and_comments` tokenizer function in `src/mjs_tok.c`. All release versions from 1.0 through 1.26 are confirmed affected per EUVD-2026-73943. A public proof-of-concept exploit has been disclosed via VulDB, the vendor has not responded to the issue report, and no patch has been released at time of analysis.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Stack-based buffer overflow in the NETGEAR RAX series router management UI (RAX30, RAX35, RAX38, RAX40, RAXE300) enables an adjacent-network attacker holding valid WiFi credentials to crash the web management interface. The vendor explicitly bounds the impact to management UI unavailability - core router services including the WiFi network and routing plane continue operating normally with no confidentiality or integrity exposure. CVSS 3.5 reflects this constrained scope; no public exploit code exists and no active exploitation has been identified.
Buffer over-read (CWE-126) in Microsoft Word's document parsing code allows local disclosure of in-process memory when a victim opens a specially crafted file. All currently-supported Office release lines on Windows - 365 Apps for Enterprise, Office 2019, 2021, 2024 LTSC, and Word 2016 standalone - are affected across both x86 and x64 architectures. No public exploit code has been identified, and SSVC rates exploitation as 'none' with technical impact 'partial', consistent with the moderate CVSS 5.5 rating.
Buffer over-read (CWE-126) in Microsoft Office Word allows local information disclosure when a user opens a specially crafted document, exposing process memory contents with high-confidentiality impact. Affected builds span Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across both x86 and x64 architectures. No public exploit has been identified at time of analysis, SSVC rates exploitation as none and the attack as non-automatable, and vendor patches are available for all affected product lines.
Heap-based buffer overflow in Microsoft Office leaks sensitive memory contents to unauthenticated network attackers when a victim opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, making the exposure surface extremely broad. Vendor-released patches are available; no public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-privilege vector warrants prompt patching across enterprise fleets.
Out-of-bounds memory read in Microsoft Office Word's document parser exposes sensitive process memory to remote attackers when a victim opens a specially crafted Word file. The flaw spans Word 2016 through Office LTSC 2024 and Microsoft 365 Apps on both Windows (x86/x64) and macOS. SSVC assessment confirms no known active exploitation and the attack is not automatable, placing real-world priority below the CVSS 6.5 headline score suggests.
Remote Desktop Client on Windows crashes with a denial-of-service condition when a user connects to an attacker-controlled RDP server that triggers a CWE-190 integer overflow or wraparound in the client parsing logic. The flaw affects at least fifteen distinct Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and every Windows Server generation from 2016 through 2025. No active exploitation has been identified; SSVC rates exploitation as none and technical impact as partial, aligning with the availability-only CVSS profile.
Local code execution in Windows DHCP Server affects all major Windows Server versions from 2012 through 2025, exploitable by an authorized attacker with high-level local privileges. The vulnerability stems from an out-of-bounds read (CWE-125) in the DHCP Server role that, despite its read-class root cause, is confirmed by Microsoft to enable code execution - suggesting the OOB read yields a usable memory corruption primitive. Exploitation is substantially constrained by requiring local access, high attack complexity, and high privileges (PR:H/AC:H/AV:L), and no public exploit or active exploitation has been identified.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Winsock networking subsystem enables local privilege escalation to SYSTEM-level on a broad range of Windows client and server releases. An attacker who already holds a high-privileged (but non-SYSTEM) local account can trigger CWE-122 heap corruption through Winsock to achieve full C:H/I:H/A:H impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Heap-based buffer overflow (CWE-122) in the Windows DHCP Server service enables an authorized local attacker with administrative privileges to execute arbitrary code on affected Windows Server systems. The vulnerability spans Windows Server 2012 through 2025 as well as Windows 10 versions 1607 and 1809, and requires that the DHCP Server role be installed and running. Microsoft has released patches via the standard Windows Update channel; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Integer overflow in Microsoft Office Word's document parsing engine triggers an out-of-bounds read (CWE-125), enabling a remote unauthenticated attacker to disclose potentially sensitive memory contents by inducing a victim to open a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS. Microsoft has released patches across all affected versions; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow (CWE-122) in Microsoft SQL Server allows a network-connected attacker with high database privileges to corrupt heap memory, causing at minimum a denial-of-service crash of the SQL Server process and potentially enabling code execution. Affects SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing identified at time of analysis, though the description's claim of code execution potential warrants close attention despite vendor CVSS metrics reflecting only availability impact.
Out-of-bounds read in Microsoft SQL Server exposes server memory to authenticated low-privileged network attackers, enabling information disclosure across SQL Server 2017 through 2025. The flaw (CWE-125) is reachable over the network without elevated privileges or user interaction, making it accessible to any valid SQL Server login. Microsoft has released patches across all affected servicing branches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server allows a low-privileged, authenticated attacker to remotely disclose sensitive memory contents over a network. Affected builds span SQL Server 2017 through 2025 across both Cumulative Update and GDR servicing branches. With a CVSS 6.5 and C:H, successful exploitation could expose confidential server-side data; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds read in MongoDB Server's query planning component allows an authenticated database user with read/write privileges to disclose partial server heap memory contents. Crafted query operations cause the server to read beyond allocated heap buffer boundaries during query plan construction, with leaked memory fragments surfacing through diagnostic query statistics output. Affected releases span MongoDB Server 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8, with fixed versions available across all three branches per vendor advisory SERVER-131562.
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface name handling. Supplying an interface name of 74 bytes or more via the -i option bypasses missing length validation, causing reads beyond allocated buffer boundaries; the over-read data leaks to console output and may also be written into persistent network configuration files, risking both information disclosure and config corruption across reboots. No public exploit or active exploitation has been identified, but the upstream fix is available as a merged GitHub PR and commit.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.
Denial of service in Bestechnic BES2300 Bluetooth audio SoC firmware v3.x and earlier, where a crafted SBC audio frame overflows a buffer in SBC_DecodeFrames() and crashes the decoder. Attackers within Bluetooth radio range who can deliver audio to the device can render it unresponsive, with no confidentiality or integrity impact per the CVSS vector (C:N/I:N/A:H). EPSS is only 0.19% (9th percentile) and there is no CISA KEV listing or public exploit code identified at time of analysis.
Stack exhaustion in java-json-tools json-patch ≤1.13 enables remote unauthenticated denial of service by submitting a crafted deeply-nested JSON Merge Patch document to any application endpoint that invokes JsonMergePatch.fromJson. The vulnerability triggers an uncontrolled recursive deserialization path in JsonMergePatchDeserializer.java, causing JVM thread stack exhaustion. The CVSS 4.0 vector (VC:N/VI:N/VA:L) confirms the impact is limited to availability; no confidentiality or integrity impact has been identified. A public exploit/proof-of-concept exists in the GitHub issue tracker, and no patched release version has been independently confirmed.
Out-of-bounds write in Samsung's Escargot JavaScript engine on Linux x86-64 allows process crash when a crafted class definition is supplied for execution. Numeric truncation (CWE-197) occurs when an instance initialization entry count exceeding UINT16_MAX is stored in a uint16_t field, producing a corrupted count that drives subsequent out-of-bounds memory writes and host process termination. Impact is limited to availability (denial of service); no confidentiality or integrity exploitation is indicated, and no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation.
Out-of-bounds read in CDT (Constrained Delaunay Triangulation) before 1.4.5 crashes any application that passes attacker-supplied geometry data through the library's constraint-edge insertion path. When nearly-degenerate constraint edges are provided, floating-point rounding during intersection computation places a split vertex outside the adjacent triangles, causing opposedVertexInd() to perform an unchecked out-of-bounds array access. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.4.5.
Heap buffer over-read in ugrep before 7.6.0 allows a local attacker to crash the utility by supplying a malformed .Z (Unix compress) archive file to its LZW decompressor. The flaw, located in src/zopen.c at approximately line 673, causes the decompressor to read exactly one byte past the end of the allocated heap buffer, resulting in a process crash. The CVSS 4.0 vector confirms the impact is limited to availability at the Low severity level with no confidentiality or integrity exposure; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in libtpms during TPM 2.0 state restoration allows an adjacent unauthenticated attacker to crash the swtpm process and deny TPM services to dependent virtual machines. The flaw arises in the state-blob parser: an attacker-controlled oversized skip-block length drives the internal INT32 size counter negative; subsequent bounds checks cast that counter to UINT32, wrapping it to a large positive value and bypassing the check, which then drives the parser to read memory outside the heap buffer. Vendor and upstream commit confirm the impact is denial of service only - no data corruption or information disclosure was confirmed. No public exploit or CISA KEV listing has been identified.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. (cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)
In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2. This series fixes an off-by-one out-of-bounds read in ucs2_strnlen(). The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation. This patch (of 2): ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit. Test the length before dereferencing to prevent an off-by-one out-of-bounds read.
In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() pci_write_legacy_io() loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if (count != 1 && count != 2 && count != 4) return -EINVAL; return pci_legacy_write(bus, off, *(u32 *)buf, count); kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1), so a 1-byte write to the legacy_io sysfs file allocates 2 bytes and the unconditional u32 load reads up to 2 bytes past the end of the allocation, which KASAN reports as a slab-out-of-bounds read. Similarly, a 2-byte write overreads by 1 byte. Thus, read only the number of bytes requested using get_unaligned_le16() and get_unaligned_le32() for the 2 and 4 byte cases, interpreting the buffer as little-endian to match the byte ordering of PCI I/O port space. The PowerPC implementation previously compensated for the generic code's native-endian 32-bit load by shifting the value into place for the 1 and 2 byte cases. The shifts were only correct on big-endian kernels. On little-endian PowerPC (POWER8 and later), they extracted the wrong bytes, so a 1-byte write wrote an out-of-bounds byte instead of the requested value. On big-endian, the native load also caused out_le16() and out_le32() to reverse the user's bytes on the wire for 2 and 4 byte writes. The little-endian helpers resolve both issues, so the shifts are removed. No changes are needed for the Alpha platform. The legacy_io file is root-only and exists only on Alpha and PowerPC, the two architectures that define HAVE_PCI_LEGACY.
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback_store() Patch series "zram: fix stale scan bounds after reinitialization". Both writeback_store() and read_block_state() derive their table scan bounds from zram->disksize before acquiring dev_lock. If the device is reset and reinitialized with a smaller disksize between that read and lock acquisition, the bound can describe the old table while the scan operates on the new one. This can lead to out-of-bounds slot accesses. Move both bound calculations under dev_lock so each bound remains consistent with the table throughout its scan. Keep the fixes separate because the affected interfaces originate from different commits and can be backported independently. This patch (of 2): writeback_store() calculates the table scan bounds before taking dev_lock. A reset followed by reconfiguration with a smaller disksize can therefore replace zram->table while writeback_store() is waiting for the lock. Once it acquires the lock, it sees an initialized device but scans the new table using the old upper bound, resulting in an out-of-bounds access. Calculate the number of pages while holding dev_lock so the scan bound matches the table protected by the lock.
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on the wire and decodes cleanly into a valid uint32, but it is not a valid timespec64: tv_nsec must be less than NSEC_PER_SEC. Nothing in the setattr path clamps it. notify_change() runs the time through timestamp_truncate(), which does not reduce tv_nsec below NSEC_PER_SEC when the filesystem supports nanosecond granularity (s_time_gran == 1), and the inode atime/mtime setters store it verbatim (only ctime is normalized, via inode_set_ctime_to_ts()). The un-normalized value then corrupts on-disk metadata: ext4's ext4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which overflows the 32-bit extra field and clobbers the seconds-epoch bits, so the stored seconds (and thus the year) are wrong on read-back. XFS with bigtime mis-stores the timestamp for the same reason. Validate the client-supplied atime/mtime in the proc handlers and return NFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL for SETATTR and describes it as the error for a value the server 'can not store ... in its own representation'; the client maps it to EINVAL. Checking in the proc handlers, rather than in nfsd_setattr(), keeps the rejection in front of object creation. The create operations create the object before nfsd_create_setattr() runs, so a late failure would leave the new object behind and turn a non-idempotent request into a namespace change that reports failure. The check is therefore done up front, for the create operations before the object is created. tv_nsec is a long, so the comparison casts it to unsigned long (the same width) rather than to u32, matching timespec64_valid(). A u32 cast would truncate on 64-bit; the unsigned long cast also rejects a value that became negative when an out-of-range u32 wire nseconds was assigned to a 32-bit long. Only client-supplied times are checked: SET_TO_SERVER_TIME requests carry no client value. The sattrguard3 ctime is deliberately left alone: an out-of-range guard simply never matches the object's ctime and yields NFS3ERR_NOT_SYNC via the existing guardtime comparison, which is the protocol-correct outcome rather than rejecting the request.
In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected values to avoid this.
In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte supplied by the device in its REPORT_EE_DATA reply -- clamped only to the caller's read() count: ret = resp->raw_data[2]; if (ret > s) ret = s; if (copy_to_user(u, resp->raw_data+3, ret)) It never checks resp->raw_size, the number of bytes picolcd_raw_event() actually copied into the 64-byte raw_data[] of the kmalloc'd struct picolcd_pending. A device (or a spoofed picoLCD) returning a length byte of 0xff, read with a count >= 255, makes copy_to_user() read past raw_data[] into adjacent slab memory and return it to userspace through the debugfs "eeprom" file: BUG: KASAN: slab-out-of-bounds in _copy_to_user Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd] The debug-dump path in the same file already validates the device length byte against the received size before trusting it; this read does not. The file is created S_IRUSR (root-only) and a crafted device is needed, so it is neither unprivileged- nor remotely-triggerable. Clamp the copy length to resp->raw_size - 3 (the payload actually received, minus the 3-byte header), floored at 0 for short replies.
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() rocket_job_push() allocates a temporary array to hold all input and output GEM object pointers: bos = kvmalloc_array(job->in_bo_count + job->out_bo_count, sizeof(void *), GFP_KERNEL); memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *)); memcpy(&bos[job->in_bo_count], job->out_bos, ...); Two bugs exist: 1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference. 2. Integer overflow: in_bo_count and out_bo_count are both u32, set directly from userspace-supplied in_bo_handle_count and out_bo_handle_count with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmalloc_array() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array. Fix by using check_add_overflow() to detect count overflow before the allocation, and adding a NULL check on the allocation result.
In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build_constructor_string() Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf().
In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechdrs, section sizes and offsets are validated, unless the section type is SHT_NULL or SHT_NOBITS. Later, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring that their types are SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory when dereferenced in elf_validity_cache_secstrings or elf_validity_cache_strtab. Validate that both string section headers are of type SHT_STRTAB before caching them.
In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() sk_store() and kek_store() strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if (buf[length - 1] == '\n') length--; bioscfg_drv.spm_data.signing_key = kmemdup(buf, length, GFP_KERNEL); but then pass the original "count" (not "length") as the copy size to hp_wmi_perform_query(), which memcpy()s that many bytes out of the "length"-sized allocation, reading one byte past it whenever the write ends in a newline, the normal case for a shell "echo" into sysfs. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg] Read of size 28 at addr ffff88813c8e2b80 by task python3/16022 ... sk_store+0xa7/0x240 [hp_bioscfg] kernfs_fop_write_iter+0x3e1/0x5d0 ... The buggy address is located 0 bytes inside of allocated 27-byte region [ffff88813c8e2b80, ffff88813c8e2b9b) Reproduced identically for kek_store, and at multiple write sizes (28, 57, 201 bytes), each time reading exactly one byte past a kmemdup() allocation one byte smaller than the write. Fix by passing "length" instead of "count" to hp_wmi_perform_query() in both functions.
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire_comm_receiver_handler() forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if (!urb->status) { if (rt->receiver_buffer[0] == 0x10) /* midi in event */ if (midi_rt) midi_rt->in_received(midi_rt, rt->receiver_buffer + 2, rt->receiver_buffer[1]); } receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the device chooses, so a device that answers with 0x10 and a length of 0xFF makes snd_rawmidi_receive() read 255 bytes starting two bytes into a 64-byte object. The bytes past the buffer are handed to userspace through the rawmidi read path. urb->actual_length is not consulted either, so a short transfer leaves both the type byte and the length byte at their previous values and the handler acts on stale data. The receiver URB is submitted from usb6fire_comm_init() at probe, so the read happens on plug with no user action; forwarding to userspace also needs a MIDI input substream open, since usb6fire_midi_in_received() only calls snd_rawmidi_receive() when rt->in is set. KASAN on 7.2.0-rc5 (arm64), single packet from an emulated device: BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive Read of size 255 at addr ffff000009f64682 by task bash/183 __asan_memcpy snd_rawmidi_receive usb6fire_midi_in_received [snd_usb_6fire] usb6fire_comm_receiver_handler [snd_usb_6fire] Allocated by task 11: usb6fire_comm_init [snd_usb_6fire] usb6fire_chip_probe [snd_usb_6fire] The buggy address is located 2 bytes inside of allocated 64-byte region [ffff000009f64680, ffff000009f646c0) Reject the event when the length exceeds the bytes that follow the header, and require the transfer to have delivered the header plus that many bytes. The receiver URB is submitted with a 64-byte transfer_buffer_length, so a genuine device cannot deliver an event longer than those 62 bytes and nothing valid is dropped. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media seg_num against the cache device size seg_num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cache_seg_init() -> cache_dev_zero_range() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero seg_num makes the segment allocations ZERO_SIZE_PTR. Reject a seg_num that is zero, larger than the device can hold, or larger than PCACHE_CACHE_SEGS_MAX before it is used.
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max_payload_len svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size (SVC_I3C_FIFO_SIZE), not by the slot size. slot->data points into the IBI pool, which i3c_generic_ibi_alloc_pool() sizes at max_payload_len per slot. svc_i3c_master_request_ibi() only rejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can request a smaller one. mctp-i3c requests 1. Each readsb() then copies the controller RXCOUNT bytes (up to 31) with no check against the slot size. A device that sends more bytes than the slot holds writes past slot->data, an out-of-bounds write into the IBI pool. Bound the loop by dev->ibi->max_payload_len and clamp each read to the space left in the slot, the same way dw-i3c does. A device can still send more than the requested payload. Flush the leftover bytes from the RX FIFO so they do not leak into the next transfer.
Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Heap buffer overflow in Suricata's rule parser allows a local attacker with write access to rule files to crash the Suricata process during signature loading by supplying a crafted rule containing mixed-case frame keywords. Affected versions are all releases prior to 7.0.16 and 8.0.5. Exploitation is constrained to rule-load time rather than live traffic inspection, limiting impact to availability disruption of the IDS/IPS engine itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.
Type confusion in the Sierra Wireless HL78xx GNSS driver within Zephyr RTOS (4.4.0-4.4.1) allows an adjacent, unauthenticated attacker with GNSS signal-spoofing capability to drive the kernel-side NMEA parser into writing satellite data through a wild/garbage pointer, most likely crashing the device. The root defect is a struct member ordering invariant violation: the generic NMEA0183 match helper casts user_data directly to struct gnss_nmea0183_match_data, but hl78xx_gnss_data placed match_data as the second member (after const struct device), causing GGA/RMC callbacks to write fix data at wrong offsets and the GSV satellite callback to dereference a pointer constructed from non-pointer bytes. No public exploit exists; a vendor-released patch is available in Zephyr 4.4.2.
Buffer overflow in Bosch Sensortec COINES SDK versions 2.0 through 2.11 allows a malicious or compromised sensor evaluation board, connected to a host machine via USB or BLE, to overflow the host application's heap or stack by streaming an excessive volume of sensor samples. The root cause is that `coines_read_stream_sensor_data()` unconditionally performs a `memcpy` of the full ring buffer content without verifying whether the caller-provided destination buffer can accommodate it, because the internal `comm_intf_process_stream_response()` silently discards the requested `number_of_samples` bound. No public exploit has been identified at time of analysis, but successful exploitation could yield arbitrary code execution on the host developer machine.
Stack-based buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by submitting a SetUser SOAP request containing an excessive number of User XML elements, overwriting stack control state. Impact is limited to denial of service of the camera's ONVIF management interface, with no confidentiality or integrity compromise confirmed. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the GeoVision GV-LPC2011/LPC2211 V1.13 ONVIF CreateUsers handler allows an authenticated administrator to crash the ONVIF worker process by submitting a crafted SOAP request containing repeated User XML elements. The vulnerability overwrites stack control state, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector (PR:H, A:H only) constrains real-world impact to availability loss by credentialed administrators.
Stack-based buffer overflow in the GeoVision GV-LPC2211 V1.13 ONVIF service allows an authenticated administrator to crash the ONVIF worker by submitting a DeleteUsers SOAP request containing an unbounded number of Username elements. The overflow exhausts the stack array allocated for the username list, terminating the ONVIF worker process. Impact is limited to availability - the CVSS vector confirms no confidentiality or integrity compromise (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the ONVIF SetUser password handler of GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by supplying an excessively long password string. The sole confirmed impact is availability loss to the ONVIF service - no confidentiality or integrity impact is present per the CVSS vector (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrator-triggered stack buffer overflow in the GeoVision GV-LPC2211/LPC2011 V1.13 ONVIF service causes a crash of the ONVIF worker process. When an admin-authenticated user submits an oversized username or password value through the ONVIF CreateUsers operation, the device copies the value into a fixed-size stack buffer without bounds checking, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stack buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows any authenticated, low-privilege user to remotely crash the SSVR service by sending crafted fragmented SSVR protocol data. Both the GV-LPC2011 and GV-LPC2211 models share the affected codebase per CPE data. Impact is limited to availability loss - no code execution or data disclosure has been demonstrated, and no public exploit code has been identified at time of analysis.
Out-of-bounds write in libsthmbc.so affects Samsung Mobile devices running One UI prior to version 8.5, allowing local low-privilege attackers to corrupt memory beyond allocated buffer boundaries. The CVSS 4.0 vector assigns high confidentiality impact (VC:H), indicating the write primitive can be leveraged to read or expose sensitive adjacent memory content. No public exploit has been identified at time of analysis, and Samsung has shipped a fix in the One UI 8.5 security update.
Out-of-bounds write in libsavscmn.so, a shared library component of Samsung One UI, enables local attackers holding low-level user privileges to execute arbitrary code on affected devices. All Samsung devices running One UI prior to version 8.5 are in scope, with the fix delivered in the September 2026 One UI 8.5 security update as documented in Samsung Mobile's bulletin. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows a local low-privileged attacker to corrupt memory beyond allocated buffer boundaries, resulting in high confidentiality impact and minor integrity and availability effects. The CVSS 4.0 vector (AV:L/PR:L/UI:N/VC:H) confirms local access with low privileges is sufficient, with no user interaction required after the attacker establishes presence. No public exploit or active exploitation has been identified at time of analysis; Samsung Mobile released a patch in September 2026.
Out-of-bounds memory write in wpa_supplicant on Samsung Mobile Devices (Android 14 through 17) enables an adjacent unauthenticated attacker to corrupt process memory, with the CVSS 4.0 vector confirming potential high-confidentiality impact - likely exposure of Wi-Fi credentials or session keying material held in the wpa_supplicant process. Samsung resolved this in the SMR Sep-2026 Release 1 patch for all four affected Android generations. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stack-based buffer overflow in Samsung's PROCA (Process Authenticator) TrustZone trustlet allows a local privileged attacker to write out-of-bounds memory, resulting in high-confidentiality impact against affected Samsung Mobile Devices running Android 14 through 17. The flaw is patched in SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified; the CVSS 4.0 score of 5.6 reflects the significant exploitation barriers - local access, high privileges, high complexity, and specific prerequisite conditions all required simultaneously.
Out-of-bounds write in Samsung's libcodec2secevrcdec.so codec library exposes Samsung Mobile Devices running Android 14 through 17 to local memory corruption by low-privileged attackers. The flaw resides in a proprietary secure EVR codec decoder and was addressed in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in the Samsung-proprietary libsaviextractor.so library allows a local low-privileged attacker to corrupt memory on affected Samsung devices running Android 14 through 17. Exploitation requires code execution on the device with at minimum a standard user account, limiting the attack surface to malicious apps or post-compromise scenarios. Samsung has addressed the issue in SMR Sep-2026 Release 1; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle processing library allows local attackers to corrupt memory by exploiting improper input validation when removing style tags from subtitle content. Affected devices run Android 14 through 17 and are fixed in SMR Sep-2026 Release 1, disclosed through Samsung's monthly security bulletin. No public exploit identified at time of analysis, though the integrity impact is rated high (VI:H in CVSS 4.0), suggesting realistic potential for privilege escalation or code execution if chained with further exploitation.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle parsing library affects Samsung Mobile Devices running Android 14 through 17, exploitable by a local attacker who induces the device owner to open or play media containing a maliciously crafted subtitle track. The flaw carries a high integrity impact rating consistent with a memory-corruption primitive capable of enabling code execution within the media processing context, patched in the SMR Sep-2026 Release 1 monthly security update. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read via integer overflow in the HarmonyOS graphics module exposes affected devices to a denial-of-service condition. Exploitation targets HarmonyOS 6.1.0 and, per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), requires no authentication or user interaction - suggesting a network-facing graphics processing pathway is reachable without privilege. The sole confirmed impact is availability (A:L), consistent with a crash or partial service disruption in the graphics subsystem; no confidentiality or integrity impact is reported. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.
Out-of-bounds read in stb_truetype's stbtt_GetGlyphShape function enables denial of service against any application that parses attacker-supplied TrueType font files using the nothings/stb library at commit 31c1ad3. The affected function reads glyph outline data from a crafted TTF without sufficient bounds validation, causing an abnormal read that crashes the host application. No public exploit code or CISA KEV listing was identified at time of analysis; CVSS 4.3 with UI:R reflects the realistic, user-triggered exposure.
Out-of-bounds memory read in the stb library's stbsp_vsnprintf function (stb_sprintf.h) at commit 31c1ad3 enables a denial-of-service condition when a consuming application passes attacker-controlled input to the function. The nothings/stb project is Sean Barrett's widely-vendored, public-domain, single-file C library suite embedded across game engines, imaging tools, and embedded systems. No public exploit code and no CISA KEV listing exist at time of analysis; the local attack vector and high attack complexity in the CVSS vector further limit practical exploitability.
Out-of-bounds read in GPAC v26.07.0's HTTP download subsystem (gf_dm_data_received in downloader.c) enables remote denial of service when a victim user processes a crafted HTTP response containing a malformed or pathologically large chunk-size value. The upstream fix commit confirms two root causes: absence of an upper-bound cap on parsed chunk sizes and an unchecked integer overflow in the nbBytes + hdr_size computation that causes accounting to wrap around before the out-of-bounds read occurs. Impact is limited to application crash with no confidentiality or integrity consequences; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. No public exploit has been identified at time of analysis, and CVSS UI:R confirms that exploitation requires a user to initiate a connection to an attacker-controlled media source.
Out-of-bounds read in DPDK's lib/vhost virtio-net control-queue handler allows a local low-privileged attacker - such as a guest VM user with access to the virtio-net control virtqueue - to trigger an unchecked read of command_data, crashing the host-side DPDK vhost process. Affected deployments include NFV platforms, cloud hypervisors, and telco packet-processing stacks that use DPDK vhost-user for guest I/O. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 3.3 reflects local access and limited availability impact.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.
Heap-based buffer overflow in Cesanta mJS up to version 1.26 allows unauthenticated remote attackers to achieve partial memory corruption by supplying crafted JavaScript input that triggers the `skip_spaces_and_comments` tokenizer function in `src/mjs_tok.c`. All release versions from 1.0 through 1.26 are confirmed affected per EUVD-2026-73943. A public proof-of-concept exploit has been disclosed via VulDB, the vendor has not responded to the issue report, and no patch has been released at time of analysis.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Stack-based buffer overflow in the NETGEAR RAX series router management UI (RAX30, RAX35, RAX38, RAX40, RAXE300) enables an adjacent-network attacker holding valid WiFi credentials to crash the web management interface. The vendor explicitly bounds the impact to management UI unavailability - core router services including the WiFi network and routing plane continue operating normally with no confidentiality or integrity exposure. CVSS 3.5 reflects this constrained scope; no public exploit code exists and no active exploitation has been identified.
Buffer over-read (CWE-126) in Microsoft Word's document parsing code allows local disclosure of in-process memory when a victim opens a specially crafted file. All currently-supported Office release lines on Windows - 365 Apps for Enterprise, Office 2019, 2021, 2024 LTSC, and Word 2016 standalone - are affected across both x86 and x64 architectures. No public exploit code has been identified, and SSVC rates exploitation as 'none' with technical impact 'partial', consistent with the moderate CVSS 5.5 rating.
Buffer over-read (CWE-126) in Microsoft Office Word allows local information disclosure when a user opens a specially crafted document, exposing process memory contents with high-confidentiality impact. Affected builds span Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across both x86 and x64 architectures. No public exploit has been identified at time of analysis, SSVC rates exploitation as none and the attack as non-automatable, and vendor patches are available for all affected product lines.
Heap-based buffer overflow in Microsoft Office leaks sensitive memory contents to unauthenticated network attackers when a victim opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, making the exposure surface extremely broad. Vendor-released patches are available; no public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-privilege vector warrants prompt patching across enterprise fleets.
Out-of-bounds memory read in Microsoft Office Word's document parser exposes sensitive process memory to remote attackers when a victim opens a specially crafted Word file. The flaw spans Word 2016 through Office LTSC 2024 and Microsoft 365 Apps on both Windows (x86/x64) and macOS. SSVC assessment confirms no known active exploitation and the attack is not automatable, placing real-world priority below the CVSS 6.5 headline score suggests.
Remote Desktop Client on Windows crashes with a denial-of-service condition when a user connects to an attacker-controlled RDP server that triggers a CWE-190 integer overflow or wraparound in the client parsing logic. The flaw affects at least fifteen distinct Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and every Windows Server generation from 2016 through 2025. No active exploitation has been identified; SSVC rates exploitation as none and technical impact as partial, aligning with the availability-only CVSS profile.
Local code execution in Windows DHCP Server affects all major Windows Server versions from 2012 through 2025, exploitable by an authorized attacker with high-level local privileges. The vulnerability stems from an out-of-bounds read (CWE-125) in the DHCP Server role that, despite its read-class root cause, is confirmed by Microsoft to enable code execution - suggesting the OOB read yields a usable memory corruption primitive. Exploitation is substantially constrained by requiring local access, high attack complexity, and high privileges (PR:H/AC:H/AV:L), and no public exploit or active exploitation has been identified.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Winsock networking subsystem enables local privilege escalation to SYSTEM-level on a broad range of Windows client and server releases. An attacker who already holds a high-privileged (but non-SYSTEM) local account can trigger CWE-122 heap corruption through Winsock to achieve full C:H/I:H/A:H impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Heap-based buffer overflow (CWE-122) in the Windows DHCP Server service enables an authorized local attacker with administrative privileges to execute arbitrary code on affected Windows Server systems. The vulnerability spans Windows Server 2012 through 2025 as well as Windows 10 versions 1607 and 1809, and requires that the DHCP Server role be installed and running. Microsoft has released patches via the standard Windows Update channel; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Integer overflow in Microsoft Office Word's document parsing engine triggers an out-of-bounds read (CWE-125), enabling a remote unauthenticated attacker to disclose potentially sensitive memory contents by inducing a victim to open a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS. Microsoft has released patches across all affected versions; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow (CWE-122) in Microsoft SQL Server allows a network-connected attacker with high database privileges to corrupt heap memory, causing at minimum a denial-of-service crash of the SQL Server process and potentially enabling code execution. Affects SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing identified at time of analysis, though the description's claim of code execution potential warrants close attention despite vendor CVSS metrics reflecting only availability impact.
Out-of-bounds read in Microsoft SQL Server exposes server memory to authenticated low-privileged network attackers, enabling information disclosure across SQL Server 2017 through 2025. The flaw (CWE-125) is reachable over the network without elevated privileges or user interaction, making it accessible to any valid SQL Server login. Microsoft has released patches across all affected servicing branches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server allows a low-privileged, authenticated attacker to remotely disclose sensitive memory contents over a network. Affected builds span SQL Server 2017 through 2025 across both Cumulative Update and GDR servicing branches. With a CVSS 6.5 and C:H, successful exploitation could expose confidential server-side data; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds read in MongoDB Server's query planning component allows an authenticated database user with read/write privileges to disclose partial server heap memory contents. Crafted query operations cause the server to read beyond allocated heap buffer boundaries during query plan construction, with leaked memory fragments surfacing through diagnostic query statistics output. Affected releases span MongoDB Server 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8, with fixed versions available across all three branches per vendor advisory SERVER-131562.
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface name handling. Supplying an interface name of 74 bytes or more via the -i option bypasses missing length validation, causing reads beyond allocated buffer boundaries; the over-read data leaks to console output and may also be written into persistent network configuration files, risking both information disclosure and config corruption across reboots. No public exploit or active exploitation has been identified, but the upstream fix is available as a merged GitHub PR and commit.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.
Denial of service in Bestechnic BES2300 Bluetooth audio SoC firmware v3.x and earlier, where a crafted SBC audio frame overflows a buffer in SBC_DecodeFrames() and crashes the decoder. Attackers within Bluetooth radio range who can deliver audio to the device can render it unresponsive, with no confidentiality or integrity impact per the CVSS vector (C:N/I:N/A:H). EPSS is only 0.19% (9th percentile) and there is no CISA KEV listing or public exploit code identified at time of analysis.
Stack exhaustion in java-json-tools json-patch ≤1.13 enables remote unauthenticated denial of service by submitting a crafted deeply-nested JSON Merge Patch document to any application endpoint that invokes JsonMergePatch.fromJson. The vulnerability triggers an uncontrolled recursive deserialization path in JsonMergePatchDeserializer.java, causing JVM thread stack exhaustion. The CVSS 4.0 vector (VC:N/VI:N/VA:L) confirms the impact is limited to availability; no confidentiality or integrity impact has been identified. A public exploit/proof-of-concept exists in the GitHub issue tracker, and no patched release version has been independently confirmed.
Out-of-bounds write in Samsung's Escargot JavaScript engine on Linux x86-64 allows process crash when a crafted class definition is supplied for execution. Numeric truncation (CWE-197) occurs when an instance initialization entry count exceeding UINT16_MAX is stored in a uint16_t field, producing a corrupted count that drives subsequent out-of-bounds memory writes and host process termination. Impact is limited to availability (denial of service); no confidentiality or integrity exploitation is indicated, and no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation.
Out-of-bounds read in CDT (Constrained Delaunay Triangulation) before 1.4.5 crashes any application that passes attacker-supplied geometry data through the library's constraint-edge insertion path. When nearly-degenerate constraint edges are provided, floating-point rounding during intersection computation places a split vertex outside the adjacent triangles, causing opposedVertexInd() to perform an unchecked out-of-bounds array access. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.4.5.
Heap buffer over-read in ugrep before 7.6.0 allows a local attacker to crash the utility by supplying a malformed .Z (Unix compress) archive file to its LZW decompressor. The flaw, located in src/zopen.c at approximately line 673, causes the decompressor to read exactly one byte past the end of the allocated heap buffer, resulting in a process crash. The CVSS 4.0 vector confirms the impact is limited to availability at the Low severity level with no confidentiality or integrity exposure; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in libtpms during TPM 2.0 state restoration allows an adjacent unauthenticated attacker to crash the swtpm process and deny TPM services to dependent virtual machines. The flaw arises in the state-blob parser: an attacker-controlled oversized skip-block length drives the internal INT32 size counter negative; subsequent bounds checks cast that counter to UINT32, wrapping it to a large positive value and bypassing the check, which then drives the parser to read memory outside the heap buffer. Vendor and upstream commit confirm the impact is denial of service only - no data corruption or information disclosure was confirmed. No public exploit or CISA KEV listing has been identified.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. (cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)