Buffer Overflow
Monthly
Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft Windows App for Mac (versions 11.0.0 through 11.3.8) enables a remote unauthenticated attacker to disclose sensitive memory contents over the network when a victim connects to a malicious Remote Desktop server. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability without attacker authentication, though successful exploitation requires the victim to initiate or be lured into an RDP session. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch to version 11.3.9 is available from Microsoft.
Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.
Heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote, low-privileged authenticated attacker to overwrite adjacent memory regions by triggering an integer underflow in the bounds checking logic. The CVSS scope change (S:C) reflects that the overwrite can cross component boundaries, though direct impact is rated low integrity only with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing are identified at time of analysis; a vendor patch is available.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local, high-privileged attacker to execute arbitrary code. The vulnerability is rooted in a memory corruption flaw (CWE-787) that can corrupt adjacent memory regions during a write operation. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Local denial-of-service in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a high-privileged local attacker to crash the system via an out-of-bounds write condition. The attack is constrained to local access with elevated privileges (PR:H per CVSS), limiting the practical blast radius primarily to insider threats or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency triage category despite the severity of the availability impact.
Out-of-bounds memory read in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local authenticated attacker to disclose sensitive information from adjacent memory regions. The flaw is constrained entirely to local access with low privileges, yielding a CVSS score of 3.3 (Low), and poses greatest risk in shared or multi-tenant Power Systems environments where untrusted users hold shell access. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Partition firmware in IBM PowerVM Hypervisor across firmware streams FW950 through FW1120 is vulnerable to a denial-of-service attack during iSCSI SAN network boot. An unauthenticated attacker with adjacent-network access can disrupt the boot sequence of a target partition, preventing it from completing initialization while leaving all other partitions and the managed POWER system entirely unaffected. Patch available per vendor advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 exposes sensitive system memory to locally authenticated users holding low-privilege accounts. The flaw (CWE-125) allows an attacker with existing local access to read memory contents beyond intended buffer boundaries, producing high confidentiality impact while leaving system integrity and availability unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory 7283858.
Out-of-bounds read (CWE-125) in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes a remotely reachable attack surface that allows unauthenticated network attackers to cause a denial of service under high-complexity conditions. The CVSS vector also records a limited integrity impact (I:L), which is inconsistent with the description's exclusive mention of denial of service and warrants verification against the vendor advisory. No public exploit code or active exploitation has been identified; a vendor patch is available from IBM.
Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.
Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Stack-based buffer overflow in IBM Server Firmware's FSP firmware update process allows an authenticated administrator with adjacent network access to execute arbitrary code on the Flexible Service Processor, fully compromising the server management plane across confidentiality, integrity, and availability. Affected firmware spans four major release trains (FW950 through FW1120) deployed on IBM Power Systems servers. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, but the complete C:H/I:H/A:H impact profile makes patching a priority for any organization where FSP admin credentials or management network access could be shared or compromised.
Heap-based buffer overflow in the RTSP service of TP-Link Tapo C100 and C101 V5 IP cameras allows an authenticated attacker on the same local network segment to crash the RTSP service and force a device reboot by sending specially crafted frames with oversized length values. Impact is limited to temporary denial-of-service; no confidentiality or integrity compromise is achievable. No public exploit code has been identified at time of analysis, and TP-Link has released firmware patches for affected devices.
Out-of-bounds read in FreeRDP's planar RLE bitmap decoder allows a malicious RDP server to crash connecting clients and potentially disclose adjacent heap or stack memory. The flaw exists in planar_decompress_plane_rle and planar_decompress_plane_rle_only within libfreerdp/codec/planar.c across all FreeRDP releases prior to 3.29.0. An attacker operating or controlling an RDP server can exploit this by sending a specially truncated planar bitmap or surface update whose RLE control byte claims more raw bytes than the buffer contains, triggering the decoder to read beyond the allocated source buffer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Stack out-of-bounds write in Wazuh's root-level remoted daemon allows an authenticated agent to crash manager message processing by sending a specially crafted compressed payload over TCP port 1514. Versions 1.0.0 through 4.14.5 (stable) and 5.0.0-beta1 are affected; the decompression function writes a null terminator one byte beyond the stack buffer boundary when the message expands to exactly OS_MAXSTR bytes, corrupting the daemon stack and disrupting all agent communications. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; fixed versions 4.14.6 and 5.0.0-beta2 are available.
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to a device's USB port to achieve full system compromise by connecting a malicious USB device. The vulnerability spans a wide range of RoomOS versions across the 10.x, 11.x, and 26.x release families, covering the Cisco Webex Room and Board series of video collaboration endpoints. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the root-level impact (C:H/I:H) and the unattended nature of conference room hardware make this a meaningful physical security risk.
Integer overflow in cgltf through version 1.15 allows remote attackers to bypass the library's accessor bounds validation, triggering a heap out-of-bounds read that produces both partial heap memory disclosure and reliable application crashes. Any software embedding cgltf - including game engines, 3D editors, and automated asset pipeline tools - that processes externally sourced .gltf or .glb files is exposed to this dual-impact flaw affecting the cgltf_validate() and cgltf_accessor_read_float() call chain. A publicly available proof-of-concept has been confirmed via a GitHub issue report; no active exploitation has been recorded in CISA KEV at time of analysis.
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who controls the victim's HOME environment variable to trigger an out-of-bounds read and write. By supplying a HOME path longer than 255 characters, the uchar_t homelen variable wraps to zero; the expression (homelen - 1) promotes to signed int as -1, indexing one byte before the intended path buffer. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects the constrained attack conditions requiring local access and active user interaction.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.
Heap overread in swtpm's SWTPM_NVRAM_CheckHeader() function allows local low-privileged users to crash the swtpm daemon and leak heap memory contents to system logs on Red Hat Enterprise Linux 8, 9, and 10. The root cause is a classic sizeof-pointer vs. sizeof-struct confusion: the guard compares buffer length against sizeof(bh) (pointer width, 8 bytes on 64-bit) rather than sizeof(*bh) (actual struct size), permitting undersized buffers to bypass validation and triggering a 2-byte heap overread on 64-bit systems or 6 bytes on 32-bit. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write and read in libheif 1.23.0 and earlier allows an attacker who can supply a crafted HEIF/AVIF image sequence to corrupt heap memory during any application decode-then-re-encode workflow. The flaw stems from the uncompressed encoder allocating output buffers from primary image dimensions (e.g., 2x2) while copying each component plane using that plane's actual stored size (e.g., a mismatched 256x256 alpha plane), writing 65536 pixels worth of data into a 4-pixel allocation. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix commit includes a purpose-built regression test that directly reproduces the heap overflow, confirming the root cause.
Remote denial-of-service in Zephyr RTOS's Precision Time Protocol stack (versions 3.7.0 through pre-4.4.2) allows any link-adjacent unauthenticated attacker to crash a CONFIG_PTP-enabled node by sending a crafted PTP frame carrying an undefined message type (0xE or 0xF). The 4-bit wire-type field is used without an upper-bound check to index a 14-entry msg_size[] array, and the out-of-range value is subsequently reused as a TLV parsing budget, driving further out-of-bounds reads and in-place byte-swap writes past the received message slab. No public exploit code or CISA KEV listing exists at time of analysis, but the crash path is described in the upstream advisory as reliably reproducible with no authentication required from the link layer.
Stack buffer overflow and off-by-one NUL-write vulnerabilities in the Sierra Wireless HL7800 cellular modem driver within Zephyr RTOS (versions 2.4.0 through 4.4.1) allow an attacker controlling a rogue LTE base station or a compromised modem baseband to crash or potentially execute arbitrary code in kernel context. Roughly twenty AT response handlers incorrectly size the destination argument to net_buf_linearize(), placing the null terminator one byte past a 128-byte stack buffer; the +KCELLMEAS handler is the most critical, passing the raw wire length as the destination size and enabling a full, attacker-content-driven stack overflow that runs in the driver's RX kernel thread. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Malformed GeoJSON coordinate parsing in adaguc-server prior to 7.2.2 allows an unauthenticated WMS request to crash the backend worker process via out-of-bounds heap read or NULL pointer dereference in CConvertGeoJSON.cpp. The coordinate parser indexes into coordinate arrays without first verifying the JSON node type or minimum array length, affecting all four major geometry branches: Polygon, LineString, MultiLineString, and MultiPolygon. No active exploitation is confirmed (not in CISA KEV), but four distinct PoC GeoJSON payloads are publicly documented in the fix PR and GitHub advisory GHSA-mwgv-59vv-rp2m, making targeted denial-of-service straightforward once the conditions are met.
Out-of-bounds read in libmodplug through 0.8.9.1 allows a local attacker to cause the library to read one byte before the static `pat_loops` array by supplying a crafted 32-byte MIDI file to the `ModPlug_Load` entry point. The flaw in `pat_smplooped` (src/load_pat.cpp:213-217) arises because `smpno` defaults to zero and the function subtracts one before indexing the array without a lower-bound check, so a MIDI note event processed before any instrument assignment triggers `pat_loops[-1]`. The leaked byte influences loop-playback state and discloses one byte of adjacent static storage; no public exploit code or CISA KEV listing exists at time of analysis.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Zabbix's script item and preprocessing JavaScript HttpRequest logic allows an authenticated administrator, operating from an adjacent network position, to read process memory beyond allocated buffer boundaries. Exploitation results in confidentiality loss - sensitive data resident in process memory may be exposed to the attacker. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The `convert_gguf_to_hf_tokenizer` function in `mistralrs-core/src/gguf/gguf_tokenizer.rs` uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. Publicly available exploit code exists, vendor-released patch version 0.8.23 is confirmed, and no CISA KEV listing is present at time of analysis.
Memory corruption via race condition in Safari's web content processing causes unexpected application crashes on iOS, iPadOS, and macOS. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2, covering both the legacy 18.x and current 26.x release trains. No public exploit identified at time of analysis, and exploitation requires high attack complexity due to the race condition timing requirement, making opportunistic mass exploitation unlikely.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (improper restriction of buffer operations). Affected platforms span iOS and iPadOS prior to versions 18.7.10 and 26.6.1, as well as macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this availability-only denial-of-service by inducing a victim to visit a crafted webpage; no confidentiality or integrity impact is indicated by the CVSS vector. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Kernel memory corruption in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app to cause unexpected system termination or corrupt kernel memory through improper memory buffer handling. Affected versions are iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple having released patches via security advisories at support.apple.com. No public exploit code has been identified and EPSS stands at 0.15% (5th percentile), indicating low observed exploitation probability at time of analysis.
Memory corruption in Apple's web content processing stack affects iOS and iPadOS prior to version 26.6.1 and macOS Tahoe prior to 26.6.2, triggered when a user processes maliciously crafted web content. Classified under CWE-119 (improper bounds restriction), the flaw carries a CVSS 5.4 medium rating reflecting limited confidentiality and integrity impact without availability disruption. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV, making this a standard patch-cycle priority rather than an emergency response item.
Out-of-bounds read (CWE-125) in Safari's web content processing engine causes an application crash when parsing maliciously crafted web pages, affecting iOS, iPadOS, and macOS Tahoe. Impacted platforms include iOS and iPadOS below versions 18.7.10 and 26.6.1, and macOS Tahoe below 26.6.2. Apple has shipped patches across all affected release branches; no public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in Apple's web content processing engine affects iOS, iPadOS, and macOS Tahoe, allowing a remote unauthenticated attacker to trigger CWE-119 buffer mismanagement when a user processes maliciously crafted web content. Affected platforms span both the legacy iOS 18.x branch and the current iOS/iPadOS 26.x line, as well as macOS Tahoe 26.x, indicating broad reach across Apple's device ecosystem. No public exploit identified at time of analysis; EPSS score of 0.14% (4th percentile) reflects very low current exploitation probability, and the vulnerability is not listed in CISA KEV.
Safari on iOS and iPadOS prior to version 18.7.10 crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability is network-delivered but requires user interaction - a victim must open the crafted page in Safari - and its impact is limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code is identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Safari crashes on Apple iOS, iPadOS, and macOS when processing maliciously crafted web content due to a state management defect classified under CWE-119 (buffer boundary violation). Affected platforms span iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this denial-of-service condition by luring a user to a specially crafted webpage, though impact is limited to an application crash with no confirmed confidentiality or integrity consequence. No public exploit identified at time of analysis, and EPSS at 0.14% (4th percentile) signals negligible current attacker interest.
Memory corruption in Apple's Safari browser across iOS, iPadOS, and macOS Tahoe allows remote attackers to crash Safari by delivering maliciously crafted web content, requiring only passive user interaction - visiting a malicious page. Impact is strictly limited to availability (denial of service via browser crash); no confidentiality or integrity compromise is indicated by either the description or the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) signals very low exploitation probability; Apple has released patches across all affected platforms.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content due to improper memory handling (CWE-119) in the underlying WebKit engine. Affected users on iOS/iPadOS below 18.7.10 or 26.6.1, and macOS Tahoe below 26.6.2, are exposed to a denial-of-service condition triggered by visiting an attacker-controlled webpage. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (4th percentile) indicates very low exploitation probability in the wild.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content, caused by improper state management in the WebKit rendering engine. Affected platforms span iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No exploitation has been identified at time of analysis - EPSS sits at the 4th percentile - and impact is strictly confined to availability, making this a standard-cycle patch rather than an emergency response for most organizations.
Safari crashes unexpectedly when processing maliciously crafted web content on Apple platforms due to a buffer boundary violation (CWE-119) in the WebKit rendering engine. Affected are all iOS and iPadOS releases prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. The impact is limited to availability - an attacker-controlled webpage can force Safari to crash - with no confirmed confidentiality or integrity consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Memory corruption via a race condition in Apple's web content processing engine (WebKit) causes Safari to crash when a user loads maliciously crafted content on iOS, iPadOS, or macOS Tahoe. The root cause is an improper locking deficiency (CWE-362), confirmed by Apple's own description of the fix as "improved locking." No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Apple has released patches across all affected platforms.
Out-of-bounds read in Apple iOS, iPadOS, and macOS kernel components allows a low-privileged local app to trigger unexpected system termination or disclose sensitive kernel memory. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing emergency point releases to address the flaw. No public exploit or active exploitation has been identified (not in CISA KEV), and EPSS sits at the 5th percentile (0.15%), indicating very low likelihood of observed exploitation at this time.
Heap buffer overflow in hashcat's KeePass AESKDF/KDBX v4 cracking module (module_34301.c) exposes master branch builds after v7.1.2 to heap memory corruption when a privileged operator processes a crafted hash file containing an oversized ninth token field. The parser accepted up to 600 hex characters for a field decoded into a fixed 256-byte buffer with no length check, enabling up to 44 bytes of out-of-bounds writes into adjacent esalt fields and heap chunk metadata. No public exploit exists and the vulnerability is not listed in CISA KEV; an upstream fix commit is confirmed available.
Out-of-bounds stack read and write in the WNC-M14A2A LTE-M modem driver (wncm14a2a.c) within Zephyr RTOS versions 1.13.0 through below 4.4.2 allows a rogue cellular base station or RF attacker to crash the modem RX thread and leak adjacent stack memory without any application interaction. The defect fires automatically on receipt of an unsolicited %NOTIFYEV: event whose payload exceeds 39 bytes and lacks a quote character within the linearized region, causing scanning loop indices to walk past the fixed 40-byte stack buffer. While the write primitive is weakly controlled — limiting demonstrated impact to denial of service and stack disclosure — the CVE is tagged RCE by reporters, though the description explicitly states memory-safe code execution has not been demonstrated. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read in Zephyr RTOS's 6LoWPAN IPHC uncompression layer allows any unauthenticated attacker on the same IEEE 802.15.4 radio link to crash the receiving device by transmitting a single malformed frame. The flaw resides in get_ihpc_inlined_size() (subsys/net/ip/6lo.c), where a 4-bit index derived directly from the received IPHC dispatch word can reach values 13-15, all beyond the 13-entry da_inline_size_table, producing an out-of-bounds read that corrupts the computed inline size and subsequently underflows a size_t difference. No public exploit or CISA KEV listing exists at time of analysis; the fix is confirmed upstream.
Buffer overflow in Open Asset Import Library (Assimp) commit 17c12da allows remote attackers to cause memory corruption by supplying a crafted MDL7 format 3D model file. The `ParseBoneTrafoKeys_3DGS_MDL7` function in `MDLLoader.cpp` fails to validate that the bone transformation matrix span derived from `transmatrix_count` and `bonetrans_stc_size` falls within the bounds of the loaded file, allowing heap memory reads or writes beyond the allocated buffer. A public proof-of-concept exploit exists, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 score of 2.1 reflects limited individual component impact, though buffer overflows in file parsers carry inherent code execution risk that warrants prompt patching.
Buffer overflow in Open Asset Import Library (Assimp) commit 17c12da allows remote attackers to corrupt memory by delivering a maliciously crafted MDL7 3D model file to a victim application. The vulnerable function `GenerateOutputMeshes_3DGS_MDL7` in `MDLLoader.cpp` fails to enforce buffer bounds during mesh generation, resulting in low-severity integrity and availability impact per CVSS 4.0 (score: 2.1). A public proof-of-concept exploit has been disclosed; no vendor patch exists as the project has not responded to the coordinated disclosure.
Heap-based buffer overflow in Open Asset Import Library (Assimp) at commit 17c12da allows remote attackers to corrupt heap memory by supplying a crafted MDL7 3DGS format file that triggers out-of-bounds writes in the AddBonesToNodeGraph_3DGS_MDL7 function via a manipulated bones_num argument. Any application embedding Assimp that accepts untrusted 3D model files is exposed, with no vendor patch released as the project has not responded to disclosure. A publicly available proof-of-concept exploit exists, meaningfully lowering the exploitation bar for opportunistic attackers.
Heap-based buffer overflow in Assimp's 3DGS MDL7 model parser allows remote attackers to crash applications processing maliciously crafted model files, causing a denial-of-service condition. The flaw resides in the ReadFaces_3DGS_MDL7 function and affects all Assimp versions through commit 17c12da (CPE wildcard-versioned), with a public proof-of-concept exploit already circulating on GitHub. No active exploitation is confirmed in CISA KEV; the CVSS 4.0 score of 5.3 (Medium) reflects availability-only impact gated by passive user interaction.
Heap-based buffer overflow in Open Asset Import Library (Assimp) commit 17c12da enables remote attackers to corrupt memory by supplying a crafted file processed by the decompressBlock routine in Compression.cpp. Any application embedding Assimp for 3D asset import is exposed when a user opens a malicious model file, making this a supply-chain-style risk across game engines, editors, and design tools that depend on the library. No vendor patch exists at time of analysis - the project was notified via GitHub issue #6624 but has not responded - and a public proof-of-concept archive has already been released, lowering the barrier to exploitation.
Out-of-bounds read in TrailDB 0.6 allows a remote attacker with low privileges to crash an application processing a crafted TrailDB file. The vulnerable code path is the TOC (Table of Contents) validation logic inside tdb_open() in /src/tdb.c, triggered when a maliciously formed TrailDB file is opened. Publicly available exploit code exists (CVSS 4.0 E:P); no KEV listing and no patch - the project has not responded to the coordinated disclosure filed via GitHub issue #149.
Stack-based buffer overflow in DefaultFuction's Customer-Relationship-Management-In-C-Project 2.0 exposes authenticated remote attackers to arbitrary code execution or application crash by supplying oversized input to the Customer Search Module's unsafe `gets()` call. A public proof-of-concept exploit is available on GitHub, and the project maintainer has acknowledged the issue is only 'being processed,' meaning no patch has been released. The vulnerability is not listed in CISA KEV, but the combination of network accessibility, low access complexity, and public exploit code makes it a credible risk in any environment running this software.
In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xsk_build_skb() Fix generic xmit path multi-buffer logic when packets are either too big (count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is included in fragmented packet. Introduce xdp_sock::drain_cont and act upon this flag - when it is set, keep on consuming descriptors from AF_XDP Tx ring and put them directly onto Cq. Previously these descriptors were silently lost and could never be reached again.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, and with it only three temperature source and temperature source configuration registers. The register addresses match those of NCT6106 and can be re-used. The code used a separate array to list the temperature source registers for NCT6116, but used the size of the NCT6106 register array to set the number of registers. The NCT6106 register array provides six addresses, while the temperature source register array for NCT6116 only provides three addresses. This causes a KASAN report. BUG: KASAN: global-out-of-bounds in nct6775_probe+0x936/0x46f0 [nct6775] Read of size 2 at addr ffffffffc19561a6 by task modprobe/954 ... Call Trace: dump_stack+0x7d/0xa7 print_address_description.constprop.0+0x1c/0x220 ? __kasan_kmalloc.constprop.0+0xc9/0xd0 ? __kmalloc_node_track_caller+0x194/0x5b0 ? nct6775_probe+0x936/0x46f0 [nct6775] ? nct6775_probe+0x936/0x46f0 [nct6775] ... Fix the problem by hard-coding the number of temperature and temperature configuration registers to three for NCT6116. Drop the unnecessary NCT6116_REG_TEMP_SOURCE array and re-use NCT6106_REG_TEMP_SOURCE.
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove remove_pud_mapping() and remove_p4d_mapping() obtain a child table base with pud_offset(p4dp, 0) and p4d_offset(pgd, 0), then add the index for addr. RISC-V folds page-table levels at runtime. When a level is folded, its offset helper returns the parent entry itself, but the index can still be nonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39 folds both P4D and PUD, so memory hot-remove can descend into unrelated memory and pass an invalid page to __free_pages(). This can trigger: kernel BUG at include/linux/mm.h:1810! VM_BUG_ON_PAGE(page_ref_count(page) == 0) arch_remove_memory+0x1e/0x5c try_remove_memory+0x15e/0x200 remove_memory+0x24/0x3c Only add the index when the corresponding page-table level is enabled, matching p4d_offset() and pud_offset().
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize_timer() A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set the backing snd_timer's hardware resolution to an arbitrary 64-bit value via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero. When such a timer is bound to a sequencer queue, initialize_timer() computes the tick period as tmr->ticks = 1000000000 / (r * freq); where r is that user-controlled resolution and freq is the sequencer update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250). A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for any even freq, including DEFAULT_FREQUENCY (1000), so the division faults with a divide-by-zero. The division runs under tmr->lock with interrupts disabled, so the oops leaves the spinlock held and hangs the CPU. It is reachable by an unprivileged user with access to /dev/snd/timer and /dev/snd/seq. Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+ RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0 snd_seq_timer_start+0x15e/0x2b0 snd_seq_control_queue+0x56f/0xba0 snd_seq_write+0x3e0/0x730 Reject an overflowing product with check_mul_overflow() and fall back to a single tick, which also avoids feeding a wrapped-but-nonzero divisor (e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small value) into the period computation.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-advertised bulk-OUT max_transfer makes buf_end negative. The loop guard then compares the u32 urb->transfer_buffer_length against that negative int: the usual arithmetic conversion turns buf_end into a large unsigned value, so the guard stays true and each iteration keeps appending SysEx framing and payload bytes past the end of the URB transfer buffer, which is only max_transfer bytes long. A USB device that advertises a tiny bulk-OUT endpoint can therefore trigger an attacker-length- and content-controlled heap out-of-bounds write when a process writes to the created /dev/snd/midiC*D* node. Return early when there is no room for even one SysEx, so the loop is never entered with a bound that would wrap. The loop is the last statement of the function, so bailing out is equivalent to it not running. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set When a USB audio endpoint requests full packet transfers via the fill_max descriptor flag, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize. However, maxsize is left at the original sample-rate derived value. Since u->buffer_size is allocated as maxsize * packets, the resulting DMA buffer is far too small for the requested transfer length. When the USB host controller streams up to curpacksize bytes per packet, it writes past the end of the buffer via DMA, corrupting kernel heap memory. Update maxsize to curpacksize when fill_max is set so that the allocated DMA buffer size matches the actual transfer request size. [ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usb_if->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context. Add bounds checking for ctrl_idx before the array access in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
In the Linux kernel, the following vulnerability has been resolved: x86/boot: Validate console=uart8250 baud rate to fix early boot hang When the baud rate is empty, 0, invalid, or overflows to 0 when stored as an int, the system will hang during early boot because of a division by zero in early_serial_init(). Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent an early system hang.
In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix incorrect altmap passing in error path In create_altmaps_and_memory_blocks(), when arch_add_memory() succeeds with memmap_on_memory enabled, the vmemmap pages are allocated from params.altmap. If create_memory_block_devices() subsequently fails, the error path calls arch_remove_memory() with a NULL altmap instead of params.altmap. This is a bug that could lead to memory corruption. Since altmap is NULL, vmemmap_free() falls back to freeing the vmemmap pages into the system buddy allocator via free_pages() instead of the altmap. arch_remove_memory() then immediately destroys the physical linear mapping for this memory. This injects unowned pages into the buddy allocator, causing machine checks or memory corruption if the system later attempts to allocate and use those freed pages. Fix this by passing params.altmap to arch_remove_memory() in the error path.
In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint. Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcm_update_[rx|tx]_stats() functions. The rx variant runs under bcm_rx_update_lock to prevent races when resetting the two rx counters; the tx variant runs under bcm_tx_lock and only needs to guard its own counter's overflow. As the rx path resets its values already at LONG_MAX / 100, there is no conflict between the two locking domains (bcm_rx_update_lock vs. bcm_tx_lock) even for ops that use both paths. The rx statistics update and the frames_filtered update in bcm_rx_changed() were previously performed in two separate bcm_rx_update_lock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcm_rx_handler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave frames_filtered larger than frames_abs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcm_rx_changed() to close this gap, which also removes the now unneeded extra lock/unlock pair around the traffic_flags calculation.
In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in list_version_get_info sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1], info->vers->version[2] and info->vers->next. This can cause buffer overflow. Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)".
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging The debug logging in ims_pcu_irq() unconditionally prints data from pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read. Fix this by printing from the correct buffer associated with the URB.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") moved the binding-path session key out of the session-wide sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and sized both that buffer and the on-stack copy used during binding with SMB2_NTLMV2_SESSKEY_SIZE (16): struct channel { char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; /* 16 */ ... }; ntlm_authenticate() / krb5_authenticate(): char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; /* 16 */ char *auth_key = conn->binding ? channel_key : sess->sess_key; The two writers that fill this destination still bound the copy length against CIFS_KEY_SIZE (40), not against the 16-byte buffer: ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange): if (sess_key_len > CIFS_KEY_SIZE) /* 40 */ return -EINVAL; arc4_crypt(ctx_arc4, sess_key, (char *)authblob + sess_key_off, sess_key_len); ksmbd_krb5_authenticate(): if (resp->session_key_len > sizeof(sess->sess_key)) /* 40 */ ... memcpy(sess_key, resp->payload, resp->session_key_len); On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key, so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40 bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose session key is longer than 16 bytes (a normal AES256 key is 32), writes past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow. KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called from ksmbd_decode_ntlmssp_auth_blob(). The destinations must be able to hold the full session key the length checks already permit. Size the per-channel key buffer and the two on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key.
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count ata_dev_config_cpr() takes the number of range descriptors from buf[0] of the concurrent positioning ranges log (up to 255), which the device reports independently of the log size in the GPL directory. The count is then walked at a fixed 32-byte stride in two places with no bound: the log read here, and the INQUIRY VPD page B9h emitter, which writes one descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device reporting a count larger than its own log overflows the read buffer (up to 7704 bytes past a 512-byte slab), and a count above 62 overflows the response buffer on the emit side. Bound the count once, on probe, against both the log the device returned and the number of descriptors the VPD B9h response buffer can hold (ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range count with a warning; this keeps the emitter in bounds with no separate change there.
In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwriter code does not check if the data length was changed for subsequent records, which also would never happen for valid user programs. However, a malicious user could change the data length, resulting in out of bounds user copy to the kernel buffer, and memory corruption. By default, the monwriter misc device is created with root-only permissions, so practical impact is typically low. Fix this by checking for changed data length and rejecting such records.
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: prevent unbounded recursion in offload rollback Quan Sun reported [1] a stack overflow in cls_bpf_offload_cmd(). Reproducer on netdevsim: add a skip_sw cls_bpf filter, set the bpf_tc_accept debugfs knob to 0, then `tc filter replace`. The replace calls tc_setup_cb_replace() which fails. cls_bpf_offload_cmd() then swaps prog/oldprog and recursively calls itself to roll back. But bpf_tc_accept=0 makes the rollback fail too, which triggers yet another rollback frame with the same arguments, and so on until the stack is exhausted. bpf_tc_accept is just a convenient knob for the reproducer. Any driver whose tc_setup_cb_replace() fails twice in a row can hit the same loop, so this is not a netdevsim-only issue. Two ways to fix it: 1) Have the rollback call tc_setup_cb_add() on oldprog instead of re-entering cls_bpf_offload_cmd(). 2) Mark the rollback frame with a flag and skip a second-level rollback from inside it. Go with (2). It is the smaller change and keeps the original behaviour: the rollback still goes through tc_setup_cb_replace(), so the driver gets one real chance to restore its state. If that attempt also fails, we just return the original error instead of recursing. [1]: https://lore.kernel.org/bpf/ce5a6005-3c5e-4696-9e05-eba9461dc860@std.uestc.edu.cn/T/#u
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len). When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong. Pass the correct element end, (const u8 *)tim + tim_len.
In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quoting Sashiko: This is a pre-existing issue, but I noticed that just before this block in adm1275_probe(), there might be an out-of-bounds stack read: ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer); if (ret < 0) { ... } for (mid = adm1275_id; mid->name[0]; mid++) { if (!strncasecmp(mid->name, block_buffer, strlen(mid->name))) break; } Since i2c_smbus_read_block_data() reads up to 32 bytes into the uninitialized stack array block_buffer without appending a null terminator, strncasecmp() could read past the valid bytes returned in ret. For example, if the device returns a shorter string like "adm12", checking it against "adm1275" up to the length of "adm1275" will continue reading into uninitialized stack bounds. Prevent reading uninitialized memory by zeroing the stack array.
In the Linux kernel, the following vulnerability has been resolved: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid vfs_tmpfile() never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fs{u,g}id, the ->tmpfile() instance initializes the new inode through inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return INVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1. Every other creation path already refuses this: may_o_create() (O_CREAT) and may_create_dentry() (mkdir, mknod, symlink, link) bail out with -EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot be created with an owner the filesystem cannot represent. An O_TMPFILE is no exception: it is created I_LINKABLE and linkat(2) can splice it into the namespace afterwards, so the same guarantee must hold. Add the missing fsuidgid_has_mapping() check to vfs_tmpfile(). On a non-idmapped mount the caller's fs{u,g}id always map in the superblock's user namespace, so this is a no-op there and only takes effect on an idmapped mount that does not map the caller. It applies to every filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs, ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer tmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().
Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.
Out-of-bounds write in Zephyr RTOS's LoRaWAN Fragmented Data Block Transport service corrupts the Semtech/LoRaMAC-node decoder's internal MatrixM2B recovery-matrix state when a DATA_FRAGMENT command carries frag_index_n = 0, underflowing the 1-indexed counter arithmetic to array index -1. Impact is constrained to denial of an active FUOTA (Firmware Update Over The Air) session and decoder state corruption - not code execution - despite 'RCE' appearing in the intelligence metadata tags, which directly contradicts the CVE description. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Out-of-bounds read in Capstone's cs_insn_name() public API crashes host processes when the M68K or RISCV architecture backends receive caller-controlled invalid instruction IDs that bypass missing or incomplete bounds checks. Affected are all Capstone deployments prior to 6.0.0-Alpha9 where those two architecture handles are in use and instruction ID input is not sanitized by the calling application. The demonstrated impact is strictly a denial-of-service crash; no code execution or data exfiltration was shown, and no public exploit or active exploitation has been identified at time of analysis.
Race condition in KUNBUS piControl 2.6.2 enables a local authenticated attacker to corrupt kernel heap memory and disclose adjacent kernel memory contents by issuing concurrent crafted requests through the piControl character device. The flaw resides in the event notification subsystem, where improper synchronization between threads allows an attacker to win a timing window and manipulate shared kernel state. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high-complexity, local-access nature of the attack.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
Out-of-bounds write in IBM i 7.3 through 7.6 enables a local, low-privileged attacker to execute arbitrary code or trigger a denial of service via improper bounds checking. The vulnerability is classified under CWE-787 and carries tags for RCE, memory corruption, and buffer overflow, indicating a classic memory safety failure in a privileged operating environment. No public exploit or CISA KEV listing has been identified at time of analysis, and IBM has released a patch.
Denial-of-service exposure in IBM i versions 7.3 through 7.6 enables unauthenticated remote attackers to disrupt availability via an off-by-one error in bounds checking logic (CWE-125). The CVSS vector confirms network-accessible, low-complexity, unauthenticated exploitation with limited availability impact and no confirmed confidentiality or integrity effects, though the 'Information Disclosure' tag present in source metadata creates a discrepancy worth verifying with IBM. No public exploit has been identified at time of analysis, and IBM has issued a patch through its support portal.
Out-of-bounds read in IBM i 7.3, 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to obtain sensitive information from affected systems over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable without credentials or user interaction, though the confidentiality impact is limited (C:L) with no integrity or availability consequence. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker exploiting an out-of-bounds write (CWE-787) in a network-facing component, resulting in limited availability and integrity impact. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) characterizes this as network-exploitable without credentials but requiring high attack complexity, substantially constraining real-world exploitability. No public exploit code has been identified at time of analysis, and IBM has released a patch addressed through its support advisory portal.
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers to access sensitive information beyond intended memory boundaries or disrupt service availability. The CVSS 3.1 vector confirms network accessibility with low-privilege authentication sufficient to trigger the flaw, producing both limited confidentiality exposure and an availability impact. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft Windows App for Mac (versions 11.0.0 through 11.3.8) enables a remote unauthenticated attacker to disclose sensitive memory contents over the network when a victim connects to a malicious Remote Desktop server. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability without attacker authentication, though successful exploitation requires the victim to initiate or be lured into an RDP session. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch to version 11.3.9 is available from Microsoft.
Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.
Heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote, low-privileged authenticated attacker to overwrite adjacent memory regions by triggering an integer underflow in the bounds checking logic. The CVSS scope change (S:C) reflects that the overwrite can cross component boundaries, though direct impact is rated low integrity only with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing are identified at time of analysis; a vendor patch is available.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local, high-privileged attacker to execute arbitrary code. The vulnerability is rooted in a memory corruption flaw (CWE-787) that can corrupt adjacent memory regions during a write operation. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Local denial-of-service in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a high-privileged local attacker to crash the system via an out-of-bounds write condition. The attack is constrained to local access with elevated privileges (PR:H per CVSS), limiting the practical blast radius primarily to insider threats or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency triage category despite the severity of the availability impact.
Out-of-bounds memory read in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local authenticated attacker to disclose sensitive information from adjacent memory regions. The flaw is constrained entirely to local access with low privileges, yielding a CVSS score of 3.3 (Low), and poses greatest risk in shared or multi-tenant Power Systems environments where untrusted users hold shell access. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Partition firmware in IBM PowerVM Hypervisor across firmware streams FW950 through FW1120 is vulnerable to a denial-of-service attack during iSCSI SAN network boot. An unauthenticated attacker with adjacent-network access can disrupt the boot sequence of a target partition, preventing it from completing initialization while leaving all other partitions and the managed POWER system entirely unaffected. Patch available per vendor advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 exposes sensitive system memory to locally authenticated users holding low-privilege accounts. The flaw (CWE-125) allows an attacker with existing local access to read memory contents beyond intended buffer boundaries, producing high confidentiality impact while leaving system integrity and availability unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory 7283858.
Out-of-bounds read (CWE-125) in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes a remotely reachable attack surface that allows unauthenticated network attackers to cause a denial of service under high-complexity conditions. The CVSS vector also records a limited integrity impact (I:L), which is inconsistent with the description's exclusive mention of denial of service and warrants verification against the vendor advisory. No public exploit code or active exploitation has been identified; a vendor patch is available from IBM.
Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.
Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Stack-based buffer overflow in IBM Server Firmware's FSP firmware update process allows an authenticated administrator with adjacent network access to execute arbitrary code on the Flexible Service Processor, fully compromising the server management plane across confidentiality, integrity, and availability. Affected firmware spans four major release trains (FW950 through FW1120) deployed on IBM Power Systems servers. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, but the complete C:H/I:H/A:H impact profile makes patching a priority for any organization where FSP admin credentials or management network access could be shared or compromised.
Heap-based buffer overflow in the RTSP service of TP-Link Tapo C100 and C101 V5 IP cameras allows an authenticated attacker on the same local network segment to crash the RTSP service and force a device reboot by sending specially crafted frames with oversized length values. Impact is limited to temporary denial-of-service; no confidentiality or integrity compromise is achievable. No public exploit code has been identified at time of analysis, and TP-Link has released firmware patches for affected devices.
Out-of-bounds read in FreeRDP's planar RLE bitmap decoder allows a malicious RDP server to crash connecting clients and potentially disclose adjacent heap or stack memory. The flaw exists in planar_decompress_plane_rle and planar_decompress_plane_rle_only within libfreerdp/codec/planar.c across all FreeRDP releases prior to 3.29.0. An attacker operating or controlling an RDP server can exploit this by sending a specially truncated planar bitmap or surface update whose RLE control byte claims more raw bytes than the buffer contains, triggering the decoder to read beyond the allocated source buffer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Stack out-of-bounds write in Wazuh's root-level remoted daemon allows an authenticated agent to crash manager message processing by sending a specially crafted compressed payload over TCP port 1514. Versions 1.0.0 through 4.14.5 (stable) and 5.0.0-beta1 are affected; the decompression function writes a null terminator one byte beyond the stack buffer boundary when the message expands to exactly OS_MAXSTR bytes, corrupting the daemon stack and disrupting all agent communications. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; fixed versions 4.14.6 and 5.0.0-beta2 are available.
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to a device's USB port to achieve full system compromise by connecting a malicious USB device. The vulnerability spans a wide range of RoomOS versions across the 10.x, 11.x, and 26.x release families, covering the Cisco Webex Room and Board series of video collaboration endpoints. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the root-level impact (C:H/I:H) and the unattended nature of conference room hardware make this a meaningful physical security risk.
Integer overflow in cgltf through version 1.15 allows remote attackers to bypass the library's accessor bounds validation, triggering a heap out-of-bounds read that produces both partial heap memory disclosure and reliable application crashes. Any software embedding cgltf - including game engines, 3D editors, and automated asset pipeline tools - that processes externally sourced .gltf or .glb files is exposed to this dual-impact flaw affecting the cgltf_validate() and cgltf_accessor_read_float() call chain. A publicly available proof-of-concept has been confirmed via a GitHub issue report; no active exploitation has been recorded in CISA KEV at time of analysis.
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who controls the victim's HOME environment variable to trigger an out-of-bounds read and write. By supplying a HOME path longer than 255 characters, the uchar_t homelen variable wraps to zero; the expression (homelen - 1) promotes to signed int as -1, indexing one byte before the intended path buffer. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects the constrained attack conditions requiring local access and active user interaction.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.
Heap overread in swtpm's SWTPM_NVRAM_CheckHeader() function allows local low-privileged users to crash the swtpm daemon and leak heap memory contents to system logs on Red Hat Enterprise Linux 8, 9, and 10. The root cause is a classic sizeof-pointer vs. sizeof-struct confusion: the guard compares buffer length against sizeof(bh) (pointer width, 8 bytes on 64-bit) rather than sizeof(*bh) (actual struct size), permitting undersized buffers to bypass validation and triggering a 2-byte heap overread on 64-bit systems or 6 bytes on 32-bit. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write and read in libheif 1.23.0 and earlier allows an attacker who can supply a crafted HEIF/AVIF image sequence to corrupt heap memory during any application decode-then-re-encode workflow. The flaw stems from the uncompressed encoder allocating output buffers from primary image dimensions (e.g., 2x2) while copying each component plane using that plane's actual stored size (e.g., a mismatched 256x256 alpha plane), writing 65536 pixels worth of data into a 4-pixel allocation. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix commit includes a purpose-built regression test that directly reproduces the heap overflow, confirming the root cause.
Remote denial-of-service in Zephyr RTOS's Precision Time Protocol stack (versions 3.7.0 through pre-4.4.2) allows any link-adjacent unauthenticated attacker to crash a CONFIG_PTP-enabled node by sending a crafted PTP frame carrying an undefined message type (0xE or 0xF). The 4-bit wire-type field is used without an upper-bound check to index a 14-entry msg_size[] array, and the out-of-range value is subsequently reused as a TLV parsing budget, driving further out-of-bounds reads and in-place byte-swap writes past the received message slab. No public exploit code or CISA KEV listing exists at time of analysis, but the crash path is described in the upstream advisory as reliably reproducible with no authentication required from the link layer.
Stack buffer overflow and off-by-one NUL-write vulnerabilities in the Sierra Wireless HL7800 cellular modem driver within Zephyr RTOS (versions 2.4.0 through 4.4.1) allow an attacker controlling a rogue LTE base station or a compromised modem baseband to crash or potentially execute arbitrary code in kernel context. Roughly twenty AT response handlers incorrectly size the destination argument to net_buf_linearize(), placing the null terminator one byte past a 128-byte stack buffer; the +KCELLMEAS handler is the most critical, passing the raw wire length as the destination size and enabling a full, attacker-content-driven stack overflow that runs in the driver's RX kernel thread. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Malformed GeoJSON coordinate parsing in adaguc-server prior to 7.2.2 allows an unauthenticated WMS request to crash the backend worker process via out-of-bounds heap read or NULL pointer dereference in CConvertGeoJSON.cpp. The coordinate parser indexes into coordinate arrays without first verifying the JSON node type or minimum array length, affecting all four major geometry branches: Polygon, LineString, MultiLineString, and MultiPolygon. No active exploitation is confirmed (not in CISA KEV), but four distinct PoC GeoJSON payloads are publicly documented in the fix PR and GitHub advisory GHSA-mwgv-59vv-rp2m, making targeted denial-of-service straightforward once the conditions are met.
Out-of-bounds read in libmodplug through 0.8.9.1 allows a local attacker to cause the library to read one byte before the static `pat_loops` array by supplying a crafted 32-byte MIDI file to the `ModPlug_Load` entry point. The flaw in `pat_smplooped` (src/load_pat.cpp:213-217) arises because `smpno` defaults to zero and the function subtracts one before indexing the array without a lower-bound check, so a MIDI note event processed before any instrument assignment triggers `pat_loops[-1]`. The leaked byte influences loop-playback state and discloses one byte of adjacent static storage; no public exploit code or CISA KEV listing exists at time of analysis.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Zabbix's script item and preprocessing JavaScript HttpRequest logic allows an authenticated administrator, operating from an adjacent network position, to read process memory beyond allocated buffer boundaries. Exploitation results in confidentiality loss - sensitive data resident in process memory may be exposed to the attacker. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The `convert_gguf_to_hf_tokenizer` function in `mistralrs-core/src/gguf/gguf_tokenizer.rs` uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. Publicly available exploit code exists, vendor-released patch version 0.8.23 is confirmed, and no CISA KEV listing is present at time of analysis.
Memory corruption via race condition in Safari's web content processing causes unexpected application crashes on iOS, iPadOS, and macOS. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2, covering both the legacy 18.x and current 26.x release trains. No public exploit identified at time of analysis, and exploitation requires high attack complexity due to the race condition timing requirement, making opportunistic mass exploitation unlikely.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (improper restriction of buffer operations). Affected platforms span iOS and iPadOS prior to versions 18.7.10 and 26.6.1, as well as macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this availability-only denial-of-service by inducing a victim to visit a crafted webpage; no confidentiality or integrity impact is indicated by the CVSS vector. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Kernel memory corruption in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app to cause unexpected system termination or corrupt kernel memory through improper memory buffer handling. Affected versions are iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple having released patches via security advisories at support.apple.com. No public exploit code has been identified and EPSS stands at 0.15% (5th percentile), indicating low observed exploitation probability at time of analysis.
Memory corruption in Apple's web content processing stack affects iOS and iPadOS prior to version 26.6.1 and macOS Tahoe prior to 26.6.2, triggered when a user processes maliciously crafted web content. Classified under CWE-119 (improper bounds restriction), the flaw carries a CVSS 5.4 medium rating reflecting limited confidentiality and integrity impact without availability disruption. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV, making this a standard patch-cycle priority rather than an emergency response item.
Out-of-bounds read (CWE-125) in Safari's web content processing engine causes an application crash when parsing maliciously crafted web pages, affecting iOS, iPadOS, and macOS Tahoe. Impacted platforms include iOS and iPadOS below versions 18.7.10 and 26.6.1, and macOS Tahoe below 26.6.2. Apple has shipped patches across all affected release branches; no public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in Apple's web content processing engine affects iOS, iPadOS, and macOS Tahoe, allowing a remote unauthenticated attacker to trigger CWE-119 buffer mismanagement when a user processes maliciously crafted web content. Affected platforms span both the legacy iOS 18.x branch and the current iOS/iPadOS 26.x line, as well as macOS Tahoe 26.x, indicating broad reach across Apple's device ecosystem. No public exploit identified at time of analysis; EPSS score of 0.14% (4th percentile) reflects very low current exploitation probability, and the vulnerability is not listed in CISA KEV.
Safari on iOS and iPadOS prior to version 18.7.10 crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability is network-delivered but requires user interaction - a victim must open the crafted page in Safari - and its impact is limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code is identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Safari crashes on Apple iOS, iPadOS, and macOS when processing maliciously crafted web content due to a state management defect classified under CWE-119 (buffer boundary violation). Affected platforms span iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this denial-of-service condition by luring a user to a specially crafted webpage, though impact is limited to an application crash with no confirmed confidentiality or integrity consequence. No public exploit identified at time of analysis, and EPSS at 0.14% (4th percentile) signals negligible current attacker interest.
Memory corruption in Apple's Safari browser across iOS, iPadOS, and macOS Tahoe allows remote attackers to crash Safari by delivering maliciously crafted web content, requiring only passive user interaction - visiting a malicious page. Impact is strictly limited to availability (denial of service via browser crash); no confidentiality or integrity compromise is indicated by either the description or the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) signals very low exploitation probability; Apple has released patches across all affected platforms.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content due to improper memory handling (CWE-119) in the underlying WebKit engine. Affected users on iOS/iPadOS below 18.7.10 or 26.6.1, and macOS Tahoe below 26.6.2, are exposed to a denial-of-service condition triggered by visiting an attacker-controlled webpage. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (4th percentile) indicates very low exploitation probability in the wild.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content, caused by improper state management in the WebKit rendering engine. Affected platforms span iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No exploitation has been identified at time of analysis - EPSS sits at the 4th percentile - and impact is strictly confined to availability, making this a standard-cycle patch rather than an emergency response for most organizations.
Safari crashes unexpectedly when processing maliciously crafted web content on Apple platforms due to a buffer boundary violation (CWE-119) in the WebKit rendering engine. Affected are all iOS and iPadOS releases prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. The impact is limited to availability - an attacker-controlled webpage can force Safari to crash - with no confirmed confidentiality or integrity consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Memory corruption via a race condition in Apple's web content processing engine (WebKit) causes Safari to crash when a user loads maliciously crafted content on iOS, iPadOS, or macOS Tahoe. The root cause is an improper locking deficiency (CWE-362), confirmed by Apple's own description of the fix as "improved locking." No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Apple has released patches across all affected platforms.
Out-of-bounds read in Apple iOS, iPadOS, and macOS kernel components allows a low-privileged local app to trigger unexpected system termination or disclose sensitive kernel memory. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing emergency point releases to address the flaw. No public exploit or active exploitation has been identified (not in CISA KEV), and EPSS sits at the 5th percentile (0.15%), indicating very low likelihood of observed exploitation at this time.
Heap buffer overflow in hashcat's KeePass AESKDF/KDBX v4 cracking module (module_34301.c) exposes master branch builds after v7.1.2 to heap memory corruption when a privileged operator processes a crafted hash file containing an oversized ninth token field. The parser accepted up to 600 hex characters for a field decoded into a fixed 256-byte buffer with no length check, enabling up to 44 bytes of out-of-bounds writes into adjacent esalt fields and heap chunk metadata. No public exploit exists and the vulnerability is not listed in CISA KEV; an upstream fix commit is confirmed available.
Out-of-bounds stack read and write in the WNC-M14A2A LTE-M modem driver (wncm14a2a.c) within Zephyr RTOS versions 1.13.0 through below 4.4.2 allows a rogue cellular base station or RF attacker to crash the modem RX thread and leak adjacent stack memory without any application interaction. The defect fires automatically on receipt of an unsolicited %NOTIFYEV: event whose payload exceeds 39 bytes and lacks a quote character within the linearized region, causing scanning loop indices to walk past the fixed 40-byte stack buffer. While the write primitive is weakly controlled — limiting demonstrated impact to denial of service and stack disclosure — the CVE is tagged RCE by reporters, though the description explicitly states memory-safe code execution has not been demonstrated. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read in Zephyr RTOS's 6LoWPAN IPHC uncompression layer allows any unauthenticated attacker on the same IEEE 802.15.4 radio link to crash the receiving device by transmitting a single malformed frame. The flaw resides in get_ihpc_inlined_size() (subsys/net/ip/6lo.c), where a 4-bit index derived directly from the received IPHC dispatch word can reach values 13-15, all beyond the 13-entry da_inline_size_table, producing an out-of-bounds read that corrupts the computed inline size and subsequently underflows a size_t difference. No public exploit or CISA KEV listing exists at time of analysis; the fix is confirmed upstream.
Buffer overflow in Open Asset Import Library (Assimp) commit 17c12da allows remote attackers to cause memory corruption by supplying a crafted MDL7 format 3D model file. The `ParseBoneTrafoKeys_3DGS_MDL7` function in `MDLLoader.cpp` fails to validate that the bone transformation matrix span derived from `transmatrix_count` and `bonetrans_stc_size` falls within the bounds of the loaded file, allowing heap memory reads or writes beyond the allocated buffer. A public proof-of-concept exploit exists, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 score of 2.1 reflects limited individual component impact, though buffer overflows in file parsers carry inherent code execution risk that warrants prompt patching.
Buffer overflow in Open Asset Import Library (Assimp) commit 17c12da allows remote attackers to corrupt memory by delivering a maliciously crafted MDL7 3D model file to a victim application. The vulnerable function `GenerateOutputMeshes_3DGS_MDL7` in `MDLLoader.cpp` fails to enforce buffer bounds during mesh generation, resulting in low-severity integrity and availability impact per CVSS 4.0 (score: 2.1). A public proof-of-concept exploit has been disclosed; no vendor patch exists as the project has not responded to the coordinated disclosure.
Heap-based buffer overflow in Open Asset Import Library (Assimp) at commit 17c12da allows remote attackers to corrupt heap memory by supplying a crafted MDL7 3DGS format file that triggers out-of-bounds writes in the AddBonesToNodeGraph_3DGS_MDL7 function via a manipulated bones_num argument. Any application embedding Assimp that accepts untrusted 3D model files is exposed, with no vendor patch released as the project has not responded to disclosure. A publicly available proof-of-concept exploit exists, meaningfully lowering the exploitation bar for opportunistic attackers.
Heap-based buffer overflow in Assimp's 3DGS MDL7 model parser allows remote attackers to crash applications processing maliciously crafted model files, causing a denial-of-service condition. The flaw resides in the ReadFaces_3DGS_MDL7 function and affects all Assimp versions through commit 17c12da (CPE wildcard-versioned), with a public proof-of-concept exploit already circulating on GitHub. No active exploitation is confirmed in CISA KEV; the CVSS 4.0 score of 5.3 (Medium) reflects availability-only impact gated by passive user interaction.
Heap-based buffer overflow in Open Asset Import Library (Assimp) commit 17c12da enables remote attackers to corrupt memory by supplying a crafted file processed by the decompressBlock routine in Compression.cpp. Any application embedding Assimp for 3D asset import is exposed when a user opens a malicious model file, making this a supply-chain-style risk across game engines, editors, and design tools that depend on the library. No vendor patch exists at time of analysis - the project was notified via GitHub issue #6624 but has not responded - and a public proof-of-concept archive has already been released, lowering the barrier to exploitation.
Out-of-bounds read in TrailDB 0.6 allows a remote attacker with low privileges to crash an application processing a crafted TrailDB file. The vulnerable code path is the TOC (Table of Contents) validation logic inside tdb_open() in /src/tdb.c, triggered when a maliciously formed TrailDB file is opened. Publicly available exploit code exists (CVSS 4.0 E:P); no KEV listing and no patch - the project has not responded to the coordinated disclosure filed via GitHub issue #149.
Stack-based buffer overflow in DefaultFuction's Customer-Relationship-Management-In-C-Project 2.0 exposes authenticated remote attackers to arbitrary code execution or application crash by supplying oversized input to the Customer Search Module's unsafe `gets()` call. A public proof-of-concept exploit is available on GitHub, and the project maintainer has acknowledged the issue is only 'being processed,' meaning no patch has been released. The vulnerability is not listed in CISA KEV, but the combination of network accessibility, low access complexity, and public exploit code makes it a credible risk in any environment running this software.
In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xsk_build_skb() Fix generic xmit path multi-buffer logic when packets are either too big (count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is included in fragmented packet. Introduce xdp_sock::drain_cont and act upon this flag - when it is set, keep on consuming descriptors from AF_XDP Tx ring and put them directly onto Cq. Previously these descriptors were silently lost and could never be reached again.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, and with it only three temperature source and temperature source configuration registers. The register addresses match those of NCT6106 and can be re-used. The code used a separate array to list the temperature source registers for NCT6116, but used the size of the NCT6106 register array to set the number of registers. The NCT6106 register array provides six addresses, while the temperature source register array for NCT6116 only provides three addresses. This causes a KASAN report. BUG: KASAN: global-out-of-bounds in nct6775_probe+0x936/0x46f0 [nct6775] Read of size 2 at addr ffffffffc19561a6 by task modprobe/954 ... Call Trace: dump_stack+0x7d/0xa7 print_address_description.constprop.0+0x1c/0x220 ? __kasan_kmalloc.constprop.0+0xc9/0xd0 ? __kmalloc_node_track_caller+0x194/0x5b0 ? nct6775_probe+0x936/0x46f0 [nct6775] ? nct6775_probe+0x936/0x46f0 [nct6775] ... Fix the problem by hard-coding the number of temperature and temperature configuration registers to three for NCT6116. Drop the unnecessary NCT6116_REG_TEMP_SOURCE array and re-use NCT6106_REG_TEMP_SOURCE.
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove remove_pud_mapping() and remove_p4d_mapping() obtain a child table base with pud_offset(p4dp, 0) and p4d_offset(pgd, 0), then add the index for addr. RISC-V folds page-table levels at runtime. When a level is folded, its offset helper returns the parent entry itself, but the index can still be nonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39 folds both P4D and PUD, so memory hot-remove can descend into unrelated memory and pass an invalid page to __free_pages(). This can trigger: kernel BUG at include/linux/mm.h:1810! VM_BUG_ON_PAGE(page_ref_count(page) == 0) arch_remove_memory+0x1e/0x5c try_remove_memory+0x15e/0x200 remove_memory+0x24/0x3c Only add the index when the corresponding page-table level is enabled, matching p4d_offset() and pud_offset().
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize_timer() A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set the backing snd_timer's hardware resolution to an arbitrary 64-bit value via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero. When such a timer is bound to a sequencer queue, initialize_timer() computes the tick period as tmr->ticks = 1000000000 / (r * freq); where r is that user-controlled resolution and freq is the sequencer update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250). A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for any even freq, including DEFAULT_FREQUENCY (1000), so the division faults with a divide-by-zero. The division runs under tmr->lock with interrupts disabled, so the oops leaves the spinlock held and hangs the CPU. It is reachable by an unprivileged user with access to /dev/snd/timer and /dev/snd/seq. Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+ RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0 snd_seq_timer_start+0x15e/0x2b0 snd_seq_control_queue+0x56f/0xba0 snd_seq_write+0x3e0/0x730 Reject an overflowing product with check_mul_overflow() and fall back to a single tick, which also avoids feeding a wrapped-but-nonzero divisor (e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small value) into the period computation.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-advertised bulk-OUT max_transfer makes buf_end negative. The loop guard then compares the u32 urb->transfer_buffer_length against that negative int: the usual arithmetic conversion turns buf_end into a large unsigned value, so the guard stays true and each iteration keeps appending SysEx framing and payload bytes past the end of the URB transfer buffer, which is only max_transfer bytes long. A USB device that advertises a tiny bulk-OUT endpoint can therefore trigger an attacker-length- and content-controlled heap out-of-bounds write when a process writes to the created /dev/snd/midiC*D* node. Return early when there is no room for even one SysEx, so the loop is never entered with a bound that would wrap. The loop is the last statement of the function, so bailing out is equivalent to it not running. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set When a USB audio endpoint requests full packet transfers via the fill_max descriptor flag, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize. However, maxsize is left at the original sample-rate derived value. Since u->buffer_size is allocated as maxsize * packets, the resulting DMA buffer is far too small for the requested transfer length. When the USB host controller streams up to curpacksize bytes per packet, it writes past the end of the buffer via DMA, corrupting kernel heap memory. Update maxsize to curpacksize when fill_max is set so that the allocated DMA buffer size matches the actual transfer request size. [ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usb_if->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context. Add bounds checking for ctrl_idx before the array access in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
In the Linux kernel, the following vulnerability has been resolved: x86/boot: Validate console=uart8250 baud rate to fix early boot hang When the baud rate is empty, 0, invalid, or overflows to 0 when stored as an int, the system will hang during early boot because of a division by zero in early_serial_init(). Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent an early system hang.
In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix incorrect altmap passing in error path In create_altmaps_and_memory_blocks(), when arch_add_memory() succeeds with memmap_on_memory enabled, the vmemmap pages are allocated from params.altmap. If create_memory_block_devices() subsequently fails, the error path calls arch_remove_memory() with a NULL altmap instead of params.altmap. This is a bug that could lead to memory corruption. Since altmap is NULL, vmemmap_free() falls back to freeing the vmemmap pages into the system buddy allocator via free_pages() instead of the altmap. arch_remove_memory() then immediately destroys the physical linear mapping for this memory. This injects unowned pages into the buddy allocator, causing machine checks or memory corruption if the system later attempts to allocate and use those freed pages. Fix this by passing params.altmap to arch_remove_memory() in the error path.
In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint. Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcm_update_[rx|tx]_stats() functions. The rx variant runs under bcm_rx_update_lock to prevent races when resetting the two rx counters; the tx variant runs under bcm_tx_lock and only needs to guard its own counter's overflow. As the rx path resets its values already at LONG_MAX / 100, there is no conflict between the two locking domains (bcm_rx_update_lock vs. bcm_tx_lock) even for ops that use both paths. The rx statistics update and the frames_filtered update in bcm_rx_changed() were previously performed in two separate bcm_rx_update_lock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcm_rx_handler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave frames_filtered larger than frames_abs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcm_rx_changed() to close this gap, which also removes the now unneeded extra lock/unlock pair around the traffic_flags calculation.
In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in list_version_get_info sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1], info->vers->version[2] and info->vers->next. This can cause buffer overflow. Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)".
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging The debug logging in ims_pcu_irq() unconditionally prints data from pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read. Fix this by printing from the correct buffer associated with the URB.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") moved the binding-path session key out of the session-wide sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and sized both that buffer and the on-stack copy used during binding with SMB2_NTLMV2_SESSKEY_SIZE (16): struct channel { char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; /* 16 */ ... }; ntlm_authenticate() / krb5_authenticate(): char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; /* 16 */ char *auth_key = conn->binding ? channel_key : sess->sess_key; The two writers that fill this destination still bound the copy length against CIFS_KEY_SIZE (40), not against the 16-byte buffer: ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange): if (sess_key_len > CIFS_KEY_SIZE) /* 40 */ return -EINVAL; arc4_crypt(ctx_arc4, sess_key, (char *)authblob + sess_key_off, sess_key_len); ksmbd_krb5_authenticate(): if (resp->session_key_len > sizeof(sess->sess_key)) /* 40 */ ... memcpy(sess_key, resp->payload, resp->session_key_len); On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key, so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40 bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose session key is longer than 16 bytes (a normal AES256 key is 32), writes past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow. KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called from ksmbd_decode_ntlmssp_auth_blob(). The destinations must be able to hold the full session key the length checks already permit. Size the per-channel key buffer and the two on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key.
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count ata_dev_config_cpr() takes the number of range descriptors from buf[0] of the concurrent positioning ranges log (up to 255), which the device reports independently of the log size in the GPL directory. The count is then walked at a fixed 32-byte stride in two places with no bound: the log read here, and the INQUIRY VPD page B9h emitter, which writes one descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device reporting a count larger than its own log overflows the read buffer (up to 7704 bytes past a 512-byte slab), and a count above 62 overflows the response buffer on the emit side. Bound the count once, on probe, against both the log the device returned and the number of descriptors the VPD B9h response buffer can hold (ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range count with a warning; this keeps the emitter in bounds with no separate change there.
In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwriter code does not check if the data length was changed for subsequent records, which also would never happen for valid user programs. However, a malicious user could change the data length, resulting in out of bounds user copy to the kernel buffer, and memory corruption. By default, the monwriter misc device is created with root-only permissions, so practical impact is typically low. Fix this by checking for changed data length and rejecting such records.
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: prevent unbounded recursion in offload rollback Quan Sun reported [1] a stack overflow in cls_bpf_offload_cmd(). Reproducer on netdevsim: add a skip_sw cls_bpf filter, set the bpf_tc_accept debugfs knob to 0, then `tc filter replace`. The replace calls tc_setup_cb_replace() which fails. cls_bpf_offload_cmd() then swaps prog/oldprog and recursively calls itself to roll back. But bpf_tc_accept=0 makes the rollback fail too, which triggers yet another rollback frame with the same arguments, and so on until the stack is exhausted. bpf_tc_accept is just a convenient knob for the reproducer. Any driver whose tc_setup_cb_replace() fails twice in a row can hit the same loop, so this is not a netdevsim-only issue. Two ways to fix it: 1) Have the rollback call tc_setup_cb_add() on oldprog instead of re-entering cls_bpf_offload_cmd(). 2) Mark the rollback frame with a flag and skip a second-level rollback from inside it. Go with (2). It is the smaller change and keeps the original behaviour: the rollback still goes through tc_setup_cb_replace(), so the driver gets one real chance to restore its state. If that attempt also fails, we just return the original error instead of recursing. [1]: https://lore.kernel.org/bpf/ce5a6005-3c5e-4696-9e05-eba9461dc860@std.uestc.edu.cn/T/#u
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len). When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong. Pass the correct element end, (const u8 *)tim + tim_len.
In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quoting Sashiko: This is a pre-existing issue, but I noticed that just before this block in adm1275_probe(), there might be an out-of-bounds stack read: ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer); if (ret < 0) { ... } for (mid = adm1275_id; mid->name[0]; mid++) { if (!strncasecmp(mid->name, block_buffer, strlen(mid->name))) break; } Since i2c_smbus_read_block_data() reads up to 32 bytes into the uninitialized stack array block_buffer without appending a null terminator, strncasecmp() could read past the valid bytes returned in ret. For example, if the device returns a shorter string like "adm12", checking it against "adm1275" up to the length of "adm1275" will continue reading into uninitialized stack bounds. Prevent reading uninitialized memory by zeroing the stack array.
In the Linux kernel, the following vulnerability has been resolved: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid vfs_tmpfile() never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fs{u,g}id, the ->tmpfile() instance initializes the new inode through inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return INVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1. Every other creation path already refuses this: may_o_create() (O_CREAT) and may_create_dentry() (mkdir, mknod, symlink, link) bail out with -EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot be created with an owner the filesystem cannot represent. An O_TMPFILE is no exception: it is created I_LINKABLE and linkat(2) can splice it into the namespace afterwards, so the same guarantee must hold. Add the missing fsuidgid_has_mapping() check to vfs_tmpfile(). On a non-idmapped mount the caller's fs{u,g}id always map in the superblock's user namespace, so this is a no-op there and only takes effect on an idmapped mount that does not map the caller. It applies to every filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs, ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer tmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().
Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.
Out-of-bounds write in Zephyr RTOS's LoRaWAN Fragmented Data Block Transport service corrupts the Semtech/LoRaMAC-node decoder's internal MatrixM2B recovery-matrix state when a DATA_FRAGMENT command carries frag_index_n = 0, underflowing the 1-indexed counter arithmetic to array index -1. Impact is constrained to denial of an active FUOTA (Firmware Update Over The Air) session and decoder state corruption - not code execution - despite 'RCE' appearing in the intelligence metadata tags, which directly contradicts the CVE description. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Out-of-bounds read in Capstone's cs_insn_name() public API crashes host processes when the M68K or RISCV architecture backends receive caller-controlled invalid instruction IDs that bypass missing or incomplete bounds checks. Affected are all Capstone deployments prior to 6.0.0-Alpha9 where those two architecture handles are in use and instruction ID input is not sanitized by the calling application. The demonstrated impact is strictly a denial-of-service crash; no code execution or data exfiltration was shown, and no public exploit or active exploitation has been identified at time of analysis.
Race condition in KUNBUS piControl 2.6.2 enables a local authenticated attacker to corrupt kernel heap memory and disclose adjacent kernel memory contents by issuing concurrent crafted requests through the piControl character device. The flaw resides in the event notification subsystem, where improper synchronization between threads allows an attacker to win a timing window and manipulate shared kernel state. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high-complexity, local-access nature of the attack.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
Out-of-bounds write in IBM i 7.3 through 7.6 enables a local, low-privileged attacker to execute arbitrary code or trigger a denial of service via improper bounds checking. The vulnerability is classified under CWE-787 and carries tags for RCE, memory corruption, and buffer overflow, indicating a classic memory safety failure in a privileged operating environment. No public exploit or CISA KEV listing has been identified at time of analysis, and IBM has released a patch.
Denial-of-service exposure in IBM i versions 7.3 through 7.6 enables unauthenticated remote attackers to disrupt availability via an off-by-one error in bounds checking logic (CWE-125). The CVSS vector confirms network-accessible, low-complexity, unauthenticated exploitation with limited availability impact and no confirmed confidentiality or integrity effects, though the 'Information Disclosure' tag present in source metadata creates a discrepancy worth verifying with IBM. No public exploit has been identified at time of analysis, and IBM has issued a patch through its support portal.
Out-of-bounds read in IBM i 7.3, 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to obtain sensitive information from affected systems over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable without credentials or user interaction, though the confidentiality impact is limited (C:L) with no integrity or availability consequence. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker exploiting an out-of-bounds write (CWE-787) in a network-facing component, resulting in limited availability and integrity impact. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) characterizes this as network-exploitable without credentials but requiring high attack complexity, substantially constraining real-world exploitability. No public exploit code has been identified at time of analysis, and IBM has released a patch addressed through its support advisory portal.
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers to access sensitive information beyond intended memory boundaries or disrupt service availability. The CVSS 3.1 vector confirms network accessibility with low-privilege authentication sufficient to trigger the flaw, producing both limited confidentiality exposure and an availability impact. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.