Buffer Overflow
Monthly
Out-of-bounds read in the Windows Encrypting File System (EFS) driver exposes sensitive memory contents to any locally authenticated attacker holding standard user privileges. Affected systems span the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the patch surface extremely broad. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the combination of a low-complexity local attack and high confidentiality impact warrants prompt patching on systems where EFS is actively used.
Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows (Ring 2: Device Drivers) enables a denial-of-service condition exploitable from adjacent network position without authentication. The memory corruption flaw in the Windows WiFi driver stack can be triggered with passive user interaction, causing high availability impact to the vulnerable system and a residual low availability impact to subsequently connected systems. No public exploit code has been identified at time of analysis, and Intel has published advisory INTEL-SA-01422 addressing this issue.
Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Out-of-bounds read and conditional write in Vim 9.2.0469 through 9.2.0842 can be triggered when a text-property-anchored popup window is configured with both clipwindow and opacity settings active. The defect in `popup_mark_opacity_zindex()` (src/popupwin.c) fails to account for `w_popup_topoff` when `w_winrow` is negative, causing the function to index before the start of the screen array - a classic buffer underwrite (CWE-124). Real-world impact is constrained by the local attack vector, mandatory user interaction, and non-default feature combination required; no public exploit or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Vim's socket server backend prior to version 9.2.0842 allows a local process with access to the Vim server socket to corrupt stack memory or crash the Vim server by flooding it with client connections. The unbounded accept loop in socketserver_accept() causes file descriptors to exceed the compile-time bounds of fd_set structures and struct pollfd arrays allocated on the stack in src/channel.c and src/os_unix.c. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operating from an adjacent network, to trigger unauthorized modifications to router firmware and core functionality beyond what the admin interface normally permits. Affected hardware spans at least 19 model variants including RAX20, RAX35V2, RAX41/V2, RAX42/V2, RAX43/V2, RAX45, RAX49S, RAX50, RAXE450, RAXE500, XR1000, and XR1000V2. No public exploit code has been identified and this CVE is absent from CISA KEV; a vendor-released patch is available from NETGEAR for affected models.
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin user on an adjacent network to make unauthorized modifications to the router's software and functionality. Exploitation is highly constrained by CVSS 4.0 metrics - adjacent network access, high attack complexity, and pre-existing administrative credentials are all required, yielding an extremely low composite score of 1.9. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing real-world risk well below what the CWE-121 classification alone might suggest.
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authenticated administrator with adjacent network access to crash affected devices, causing temporary service unavailability. Affected hardware spans the MR, MS, and RAX product lines across at least 15 models and carries a CVSS 4.0 score of 1.1, reflecting the high-privilege prerequisite and narrow impact scope limited to transient availability loss. No public exploits exist and no active exploitation has been reported; vendor firmware patches are available through NETGEAR per-product support pages.
Stack-based buffer overflow across ten NETGEAR RAX-series WiFi 6 routers allows a device administrator with adjacent network access to temporarily disrupt normal device operation, producing a transient denial-of-service. The vulnerability carries a CVSS 4.0 score of 1.1, reflecting its highly constrained attack conditions: high-privilege access and adjacent network adjacency are both required, and the only impact is a brief availability disruption with no confidentiality or integrity consequence. No public exploit code exists and the vulnerability is not listed in CISA KEV; NETGEAR has released firmware patches for all affected models.
Heap out-of-bounds read in Tesseract OCR prior to version 5.5.3 allows an attacker who can supply a crafted .traineddata model file to crash the OCR process before any image processing occurs. The flaw in SquishedDawg::read_squished_dawg accepts unterminated forward-edge runs, after which num_forward_edges(0) causes last_edge to read beyond the edges_ heap buffer - triggering a process crash. No public exploit has been identified at time of analysis; vendor-released patch version 5.5.3 is available and the fix is confirmed by PR #4581 and the GitHub release tag.
Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file that causes a signed integer multiplication overflow in Convolve::DeSerialize, undersizing the forward-pass output buffer while write operations use the original unwrapped element count. Any application or user that loads an attacker-controlled model file is exposed to memory corruption that can lead to arbitrary code execution or process crash in the context of the OCR engine. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and a vendor-confirmed fix is available in Tesseract 5.5.3.
Velociraptor's NTFS parsing library contains out-of-bounds read and memory exhaustion flaws that allow a crash and denial of service when processing maliciously crafted NTFS images. All versions of Rapid7's Velociraptor (cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) are affected, with meaningful exposure limited to dead disk forensics workflows where untrusted NTFS images are ingested - live filesystem analysis is largely insulated from this attack path. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the local attack vector further constrains real-world exploitation opportunity.
Out-of-bounds heap write in Zephyr RTOS's USB device-next CDC NCM class handler allows any physical USB host to corrupt the device's shared network buffer pool by issuing standard GET_NTB_PARAMETERS or GET_NTB_INPUT_SIZE control requests with a wLength field smaller than the response structure size. The overflow is bounded at up to 27 bytes and writes only fixed device constants, making its primary impact denial of service of the USB stack rather than arbitrary code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, exploitation requires only physical USB access to a device built with the opt-in device_next stack and CDC NCM class.
Buffer overflow in Axis Communications' Signed Video Framework crashes applications that use its signed content validation tooling. Specifically, the Signed Media Verifier and Axis File Player are affected when processing maliciously crafted signed video content, while the AXIS OS device-side signed video functionality remains entirely unaffected. No public exploit code has been identified at time of analysis, and with CVSS 5.3 (Medium), the impact is limited to availability loss - a crash of the validation application - with no confidentiality or integrity consequences.
NULL pointer dereference in Zephyr RTOS's experimental device_next USB DFU class crashes any device where DFU download is enabled when a USB host sends a zero-length DFU_DNLOAD terminator after initiating a valid transfer. The result is a fatal CPU fault causing device crash or reset - impact is strictly limited to availability, with the vendor and commit diff explicitly confirming no memory corruption or information disclosure. No public exploit has been identified at time of analysis, and exploitation requires physical control of the attached USB host.
Double-free corruption in Zephyr RTOS's Bouffalo Lab BLE HCI driver crashes the BLE stack on any device using a BL60x/BL70x/BL61x on-chip controller. The driver's bt_bflb_send() unconditionally consumed a net_buf reference on all error paths via a shared 'done' label, violating the bt_hci_driver_api contract that reserves unref responsibility for the caller on failure; the subsequent caller-side unref then double-decrements the reference count, prematurely freeing a parent TX buffer that remains reachable on the connection queue and corrupting the shared net_buf pool. No public exploit identified at time of analysis; EPSS data was not supplied, and CISA KEV listing is absent.
Double-free (CWE-415) and use-after-free read (CWE-416) vulnerabilities in the Realtek BEE Bluetooth HCI driver within Zephyr RTOS expose affected devices to memory pool corruption and likely crashes when an adjacent Bluetooth peer drives heavy transmit activity toward resource-exhaustion error conditions. The bt_hci_bee_send() function in hci_bee.c violated the bt_hci_driver_api buffer-ownership contract by routing all error exits through a shared cleanup label that unconditionally called net_buf_unref(), while the Zephyr host TX path also unrefs the buffer on error return - resulting in a double free of the same net_buf and a subsequent read of freed memory via a LOG_ERR call compiled in at the default error log level. An upstream fix is confirmed via Zephyr project commit 9a684b5c314fb1d8670b01f7b6c4450a9353906c; no formally released patched version has been independently confirmed, and no public exploit has been identified at the time of this analysis.
Stack-based buffer overflow in SAP SAPSPrint Service (CWE-121) allows unauthenticated remote attackers to crash the service via specially crafted command requests, triggering an automatic service restart. The impact is limited to low availability disruption with no confidentiality or integrity compromise. No public exploit code or active exploitation has been identified at time of analysis, and SAP has addressed this vulnerability via their Security Patch Day cycle.
Concurrent access to an unprotected singleton context structure in Zephyr RTOS's UpdateHub OTA subsystem enables two independent callers - the background autohandler and user-triggered update operations - to race through prepare_fds(), producing an out-of-bounds write that corrupts adjacent struct members and disables the firmware-update path. Affected are embedded systems running Zephyr with the UpdateHub subsystem enabled, particularly those built with CONFIG_USERSPACE where unprivileged userspace threads can invoke update syscalls and actively compete with the workqueue handler. No public exploit has been identified at time of analysis, the CVSS base score is 2.5, and the vendor commit confirms no demonstrated path to code execution - impact is limited to availability of the OTA update mechanism.
Out-of-bounds memory copy in QEMU's vhost inflight migration VMState handler allows a privileged attacker with control of the migration channel to crash the destination QEMU process or corrupt heap memory. The root cause is a numeric type mismatch - the inflight buffer size is stored as uint64_t but deserialized by the VMS_VBUFFER load path as signed int32_t, so a crafted value with bit 31 set wraps to a massive size_t, causing qemu_get_buffer() to read far beyond the mmap-backed inflight region. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 4.4 reflects the realistic high-privilege barrier to exploitation.
Uninitialized-memory and out-of-bounds read in the UpdateHub OTA client of Zephyr RTOS allows a malicious or on-path UpdateHub server to crash the device update thread via a crafted probe response, producing a network-triggerable denial of service. The flaw exists in z_impl_updatehub_probe() within subsys/mgmt/updatehub/updatehub.c, where metadata_copy is allocated with k_malloc (leaving heap unzeroed) and filled via memcpy without a NUL terminator; a subsequent strlen() then scans into uninitialized heap, producing an over-long length fed to json_obj_parse(). No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but it is remotely triggerable against Zephyr devices running UpdateHub without DTLS transport protection.
Stack clash vulnerability in glibc's wordexp() function allows remote attackers to exhaust thread stack space via a crafted tilde-expanded path argument. The parse_tilde internal function uses strndupa - a GNU macro that allocates directly on the stack - to extract a username from attacker-controlled input, with no bounds check on the allocation size. Any application that passes untrusted input to wordexp() is a viable exploitation vector, making the real-world impact contingent on calling application patterns rather than glibc defaults alone. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 6.6 reflects high attack complexity due to the application-dependency prerequisite.
Heap buffer overflow in entr's run_utility() function allows a local low-privileged user to trigger memory corruption, process abort, and denial of service by supplying crafted command-line arguments or by using the slash-underscore substitution feature, which expands a short token into a longer pathname at runtime. The flaw stems from incorrect use of strlcpy()'s return value - which reflects the total source length rather than bytes written - to advance a destination pointer, causing an unsigned size_t underflow in the remaining-buffer counter and subsequent out-of-bounds heap writes. No public exploit has been identified and this vulnerability is absent from CISA KEV; an upstream fix is available via commit 2467fe0.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow. Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rx_stream failover path The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic. Limit the copy size to the missing byte count. [Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.
In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() dmar_latency_disable() intends to zero out only the single latency_statistic entry for the given type, but the memset size was computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire array starting from &lstat[type]. When type > 0, this writes beyond the end of the allocated array, corrupting adjacent memory. Fix by using sizeof(*lstat) to clear only the target entry.
In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern. Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0 Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is 0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a kernel page fault. The IB only needs to be a minimal NOP shell to schedule the job; the cleaner shader itself is emitted on the ring via emit_cleaner_shader(). Fill 16 dwords to match the allocation. v2: Use ib_size_dw variable (Lijo) (cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the values for height and stride are large. Fix the issue by multiplying with mul_u32_u32().
In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmc_ioctl_cdrom_volume() first reads the audio control mode page into a 32-byte stack buffer with cgc->buflen set to 24. If the device reports a block descriptor, the function increases cgc->buflen to include that descriptor and reads the page again. For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list by moving cgc->buffer forward by offset - 8 bytes. This drops the block descriptor from the outgoing payload and leaves a new 8-byte mode parameter header in front of the audio control page. However, cgc->buflen is left unchanged. With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8 but cgc->buflen remains 32. cdrom_mode_select() therefore asks the low level packet path to write 32 bytes from that adjusted pointer, reading 8 bytes past the end of the 32-byte stack buffer. This is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on drives that return a non-zero block descriptor length, which helps explain why it has gone unnoticed. The overread is also sent to the device as extra MODE SELECT payload, so it may not produce an obvious local failure. Reduce cgc->buflen by the same amount as the buffer pointer adjustment so the MODE SELECT transfer covers only the intended parameter list.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl(): pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself. Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed. The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).
Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream.
Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.
GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed.
Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.
Out-of-bounds memory write in libsmsd.so affects all Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1, exploitable by a local unprivileged attacker with no special privileges required. The flaw in Samsung's SMS daemon shared library allows memory corruption that could destabilize the smsd process or, with additional technique, enable code execution within the daemon's privilege context. No public exploit identified at time of analysis, and no CISA KEV listing; however, low attack complexity combined with zero privilege requirements makes this actionable for any malicious app or shell-level actor on an unpatched device.
Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.
Out-of-bounds write in Samsung's libcodec2secqcelpdec.so QCELP audio codec decoder library allows local attackers holding low-privilege execution on affected Samsung devices to corrupt adjacent memory regions, with limited confidentiality, integrity, and availability impact confined to the vulnerable system. The flaw is addressed in SMR Aug-2026 Release 1, Samsung's August 2026 Security Maintenance Release covering all prior unpatched firmware builds. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.4 reflects the strictly local attack surface and bounded impact scope.
Infinite-loop denial-of-service in libexpat before 2.8.3 allows attackers supplying crafted UTF-16 XML to hang the parsing process indefinitely via a low Unicode surrogate handled as a high surrogate in the *_toUtf16 functions. The flaw is gated by a compile-time prerequisite - only builds configured with XML_UNICODE and XML_UNICODE_WCHAR_T are vulnerable - which specifically includes Firefox and Windows-native builds of applications embedding libexpat. A concrete attack payload is publicly available in the upstream patch PR test suite; no active exploitation has been confirmed via CISA KEV at time of analysis.
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows a local attacker with low privileges to corrupt heap memory by supplying a crafted GetNamedVariableListAttributesResponse itemId argument to the MmsMapping_varAccessSpecToObjectReference function in the MMS Protocol Workflow. A public proof-of-concept exploit has been released and is available for download. The vulnerability has not yet been patched; the project was notified via GitHub issue #599 but has not responded at time of analysis. No active exploitation is confirmed by CISA KEV, though the publicly available PoC meaningfully elevates near-term risk.
Out-of-bounds memory read and write in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver allows a low-privileged thread, when explicitly granted flash device access in a CONFIG_USERSPACE build, to disclose arbitrary CPU-addressable memory or corrupt flash and invalidate cache beyond the mapped flash window. The root cause is a signed/unsigned type confusion in the offset bounds check: a crafted negative off_t value converts to a large unsigned integer and the subsequent addition wraps to a small result that passes the check, allowing memcpy to read from or program flash at attacker-controlled addresses. No public exploit code has been identified at time of analysis; exploitation is nonetheless mechanically straightforward for any attacker familiar with signed/unsigned integer confusion vulnerabilities.
Out-of-bounds kernel memory read in SonicWall Global VPN Client's SWIPsec.sys driver allows a local, low-privileged attacker to crash the host system. Affected versions are 4.10.8.1108 and earlier, running on Windows where the IPsec kernel driver is loaded by the VPN client. No public exploit identified at time of analysis, and EPSS probability stands at a very low 0.16% (5th percentile), indicating no signs of active or widespread exploitation interest.
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows an attacker on the adjacent IEC 61850 SV network segment to corrupt process memory by injecting malformed Sampled Values ASDU packets into the SVReceiver. The commit diff confirms that the parseASDU function in SVReceiver_stopThreadless assigned heap pointers for ASDU fields-svId, datSet, SmpCnt, ConfRev, RefrTm, SmpSynch, SmpRate, and SmpMod-without validating their lengths, enabling overflow via crafted field sizes. A public exploit has been released (E:P per CVSS 4.0 supplemental data); this vulnerability is not currently listed in CISA KEV but poses targeted risk to IEC 61850 substation automation and power grid environments.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap out-of-bounds write in RadiAnt DICOM Viewer is triggered when processing JPEG-compressed pixel data embedded in a crafted DICOM file, potentially enabling arbitrary code execution on the victim's workstation. Reported to CISA ICS-CERT as a medical device advisory (ICSMA-26-218-01), the vulnerability requires no privileges and only passive user interaction - consistent with file-preview or file-open workflows common in clinical imaging environments. The provided CVSS 4.0 score of 5.3 rates impact as availability-only (VA:L), which conflicts materially with the described RCE potential; this discrepancy is significant and should be independently verified. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Out-of-Bounds Read in Autodesk's image handling library crashes Revit and AutoCAD when a user opens a maliciously crafted TIF file during image import. Affected products span Revit 2024, 2026, and 2027 as well as AutoCAD and AutoCAD LT 2027, all below vendor-specified fix versions. The attack is local and requires user interaction, limiting automated mass exploitation, but remains a viable denial-of-service vector in targeted scenarios against AEC professionals who routinely handle externally sourced CAD assets. No public exploit identified at time of analysis.
Out-of-bounds heap read in llama.cpp's recurrent memory state restore path (builds b5702 through b7653) allows an attacker with write access to the slot save directory to craft a malicious slot file that triggers heap data leakage - including pointer values - into server logs, effectively defeating ASLR protections and enabling multi-stage exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalogue. An upstream fix is available as a commit to the ggml-org/llama.cpp repository, though a tagged released version past the affected build range has not been independently confirmed.
Use-after-free in MZ Automation libiec61850 up to version 1.6.1 allows a local low-privileged attacker to corrupt memory through the URCB (Unbuffered Report Control Block) dataset shadow buffer deletion path. The vulnerability exists in `deleteDataSetValuesShadowBuffer` within `reporting.c`, where the function dereferenced `self->dataSet` to compute its size after that pointer could already have been freed or set to NULL during connection teardown. A publicly available proof-of-concept exists, though no active exploitation has been confirmed via CISA KEV. The fix, released in v1.6.2 (commit 486fd57f), stores buffer size independently and adds semaphore locking to prevent the race.
Out-of-bounds heap read in the node-re2 npm package (versions <= 1.26.0) exposes up to 3 bytes of adjacent heap memory per call to JavaScript when Buffer arguments ending in a truncated multi-byte UTF-8 lead byte are passed to replace() or split(). The overread is deterministic, requires no heap grooming, and a working proof-of-concept is included in the GitHub advisory. Applications that pass only strings - not Buffers - are entirely unaffected, but those that process untrusted Buffer input through re2 are at real risk of incremental heap disclosure. No CISA KEV listing was identified; this is a library-layer flaw fixed in re2@1.26.1.
Stack buffer overrun in SecureAge CatchPulse allows a local low-privileged attacker to crash the application, producing a denial-of-service condition. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only an authenticated local session with no user interaction, making it viable for insider threats or post-compromise lateral DoS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stack-based buffer overflow in ELAN Smart-Pad Windows kernel drivers ETD.sys and ETDSMBus.sys allows a local standard-privilege user to crash the entire Windows system via a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER). The vulnerability is rooted in the Intel SMBus recovery code path: ETDSMBus.sys accepts a hardware-derived report count without enforcing an upper bound and forwards it to ETD.sys, where it drives an unbounded stack buffer copy. A proof-of-concept exists (CVSS 4.0 E:P) and no confirmed patch version has been identified from available data; no active exploitation is listed in CISA KEV at time of analysis.
Integer underflow in HDF5 through 2.3.0 allows denial of service when processing Fletcher32-filtered datasets with chunk sizes smaller than 4 bytes. The `H5Z__filter_fletcher32` function in `H5Zfletcher32.c` subtracts the 4-byte checksum length from the input buffer size using an unsigned `size_t` without first verifying the buffer meets the minimum size, causing the result to wrap near `SIZE_MAX` and triggering a massively out-of-bounds read inside `H5_checksum_fletcher32`. Any application or pipeline calling `H5Dread` on a crafted HDF5 file - including the standard `h5ls` and `h5dump` utilities - can be crashed; no public exploit code has been identified and this vulnerability is not in CISA KEV.
Out-of-bounds heap read in HDF5's N-Bit filter decompression affects all versions through 2.3.0, allowing an attacker who can deliver a crafted HDF5 file to a user or automated pipeline to trigger application crashes and, in constrained cases, leak adjacent heap memory contents into decompressed dataset values. The three affected functions - H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic - advance a buffer read index without bounding it against the actual compressed chunk size, exploitable whenever H5Dread is invoked, including via common tools like h5ls and h5repack. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.
Out-of-bounds memory read in Electron's offscreen rendering pipeline allows a compromised GPU process to cause the browser/main process to read beyond a shared memory mapping boundary when producing `paint` event images, disclosing process memory or crashing the application. Exploitation requires two independent preconditions: the host application must enable `webPreferences.offscreen` (non-default) and an attacker must have already achieved code execution in the GPU process via a separate vulnerability. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it). Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop. BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Out-of-bounds read in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows unauthenticated remote attackers to trigger memory over-reads in the multipart SIP body parser by sending a crafted message with Content-Type: multipart/mixed whose body contains "--" within two to three bytes of the buffer end. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-prerequisite exploitation with low availability impact, though the reporter's "Information Disclosure" tag conflicts with the official C:N rating, suggesting potential memory leakage beyond what the score reflects. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are confirmed in 3.6.6 and 4.0.0-rc1.
Persistent denial of service in dhcp-server (dhcpd) on Red Hat Enterprise Linux 6 through 9 is triggered via a crafted OMAPI lease creation request containing an overly long InfiniBand MAC address, overflowing a buffer in `print_hw_addr()` and crashing the dhcpd daemon in a way that prevents automatic recovery. The official CVSS score of 4.9 with PR:H reflects the assumption that TSIG authentication guards the OMAPI port; however, the description explicitly highlights that TSIG is optional and often absent, reducing the realistic exploitation barrier to unauthenticated network access. No confirmed active exploitation (KEV) or public proof-of-concept exists at time of analysis.
Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the OPC-UA client process by triggering a memory read violation in the DeleteMonitoredItemsRequest handler state machine function. The flaw is confined to the client-side wrapper component and results in an availability impact rather than code execution or data exfiltration. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to coordinated disclosure, leaving no official patch confirmed at time of analysis.
Heap-based buffer overflow in open62541 up to version 1.5.5 allows local low-privileged attackers to corrupt heap memory via the UA_Client_readNodeClassAttribute function in the client high-level API. The vulnerability is confined to local exploitation (AV:L/PR:L), limiting its network attack surface, but publicly available exploit code lowers the barrier for abuse on compromised or multi-tenant systems running open62541 OPC UA clients. The open62541 project closed the issue report as filed through unofficial channels, leaving patch status and official acknowledgment unconfirmed.
Memory corruption in Qualcomm Snapdragon's registry value processing exposes devices to potential code execution by high-privileged local attackers. The flaw, rooted in CWE-120 (classic buffer overflow), is triggered when a direct query method processes registry values supplied with incorrect types - bypassing proper type-length validation and corrupting adjacent memory. While the full C:H/I:H/A:H impact triad indicates serious consequences if reached, the PR:H (high privilege) and AV:L (local) CVSS metrics substantially narrow the realistic attack surface. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N confirms the attack is network-reachable with no authentication or complexity barriers.
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() The `ims_pcu_process_data()` processes incoming URB data byte by byte. However, it fails to check if the `read_pos` index exceeds IMS_PCU_BUF_SIZE. If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE, `read_pos` will increment indefinitely. Moreover, since `read_pos` is located immediately after `read_buf`, the attacker can overwrite `read_pos` itself to arbitrarily control the index. This manipulated `read_pos` is subsequently used in `ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a heap buffer overflow. Specifically, an attacker can overwrite the `cmd_done.wait.head` located at offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`. Consequently, when the driver calls `complete(&pcu->cmd_done)`, it triggers a control flow hijack by using the manipulated pointer. Fix this by adding a bounds check for `read_pos` before writing to `read_buf`. If the packet is too long, discard it, log a warning, and reset the parser state. [dtor: factor out resetting packet state, reset checksum as well]
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote attackers to crash the NAS service on eleven router models running firmware up to 20260707, resulting in a denial of service. The vendor confirmed the vulnerability following responsible disclosure, and the GitHub advisory explicitly identifies the impact as authenticated denial of service with no confidentiality or integrity compromise. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds read in mz-automation libiec61850 up to version 1.6.1 allows remote unauthenticated attackers to crash the IEC 61850 MMS server process and potentially leak heap or stack memory contents by sending a crafted MMS DataSet access request. The root cause is unconstrained string copy operations in the checkDataSetAccess function, now confirmed fixed in v1.6.2 via bounded copy with a 129-byte limit. A public exploit has been disclosed; however, this vulnerability is not listed in CISA KEV and the CVSS 4.0 score of 6.9 (Medium) reflects limited impact scope confined to availability of the vulnerable system.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Stack-based buffer overflow in GIMP's file-png plugin on Red Hat Enterprise Linux 6 through 9 causes the application to crash when a user opens a crafted Animated PNG (APNG) image containing an oversized tRNS chunk, resulting in a Denial of Service limited to the affected user session. Exploitation requires local file access and active user interaction - a remote attacker would rely on social engineering (phishing, malicious download) to deliver the file. No active exploitation has been confirmed by CISA KEV, no public exploit code is identified at time of analysis, and EPSS data is unavailable in source intelligence.
Out-of-bounds read in MediaTek's GeniZone trusted execution environment (TEE) exposes memory on 17 affected chipset models to local information disclosure, but only after an attacker has already acquired System-level privilege. The vulnerability stems from a missing bounds check in the geniezone driver (CWE-125, Patch ID ALPS11036877), and is tracked by MediaTek as MSV-7132. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.14% (4th percentile) and SSVC exploitation status of 'none', this is a low-urgency finding despite the breadth of affected silicon.
Out-of-bounds read in the MediaTek Wi-Fi driver component on MT6988, MT6990, and MT6890 chipsets permits local information disclosure against devices where an attacker has already obtained System-level privilege. The missing bounds check in the Wi-Fi stack allows reading memory beyond the intended buffer boundary, exposing potentially sensitive kernel or driver memory contents. No public exploit exists and EPSS at 0.13% (3rd percentile) reflects the significant privilege prerequisite that constrains real-world exploitation; CISA KEV does not list this vulnerability.
Out-of-bounds write in the wifi subsystem of MediaTek MT6890, MT6990, and MT6988 chipsets enables a local denial of service, crashing the wifi component or device. Exploitation requires that the attacker has already obtained System-level privilege on the affected device - an extremely high bar that makes this a post-exploitation nuisance rather than an initial access vector. EPSS sits at 0.13% (3rd percentile), no public exploit code exists, and the vulnerability is not listed in the CISA KEV catalog, all consistent with the substantial privilege prerequisite.
Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.
Out-of-bounds read in MediaTek's ccci (Cross Core Communication Interface) driver on multiple chipsets enables local denial of service by a System-privileged attacker. Affected chipsets include MT6813, MT6988, MT6982VB, MT6986D, and MT6986 - targeting mid-range and flagship Android SoC lines. No public exploit code exists and CISA has not added this to KEV; real-world impact is constrained by the high privilege prerequisite, making this a post-compromise availability risk rather than an initial access vector.
Local information disclosure in the display subsystem of multiple MediaTek SoC chipsets results from a CWE-125 out-of-bounds read triggered by an integer overflow. Seventeen distinct chipsets are confirmed affected per the EUVD listing, spanning devices such as MT8910, MT8188, MT8768, and MT6991 - all prevalent in mid-range and budget Android hardware. Exploitation requires an attacker who has already attained System-level privilege on the device; no public exploit exists and EPSS sits at 0.14% (4th percentile), consistent with the SSVC exploitation rating of 'none'.
Local information disclosure in MediaTek's display subsystem exposes arbitrary kernel memory to a privileged local process due to a missing bounds check (CWE-125). Exploitation is limited to actors who have already obtained System-level privileges on a device running one of 17 affected MediaTek chipsets (MT6991, MT8676, MT8799, and others). No public exploit code and no active exploitation have been identified; EPSS sits at 0.14% (4th percentile), consistent with SSVC's 'none' exploitation status and 'no automatable' classification.
Out-of-bounds write in MediaTek's HFRP component on the MT6993 chipset enables local privilege escalation beyond System-level access, confirmed via MediaTek's August 2026 security bulletin. The flaw stems from a missing bounds check (CWE-787), requiring an attacker who has already achieved System privilege to trigger further escalation - a post-compromise lateral movement primitive rather than an initial access vector. No public exploit code and no KEV listing have been identified; EPSS sits at the 3rd percentile, consistent with SSVC's 'exploitation: none' finding.
Out-of-bounds write in MediaTek's GeniZone Trusted Execution Environment (TEE) component enables local privilege escalation across 14 distinct MediaTek chipsets. An attacker who has already achieved System-level privilege on an affected Android device can exploit a missing bounds check to write outside intended memory boundaries within the secure enclave, gaining confidentiality and integrity access beyond what System privilege normally permits. No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability; however, the pre-existing System privilege prerequisite substantially narrows the realistic attack surface.
Out-of-bounds write in MediaTek's GenieZone hypervisor component enables local privilege escalation beyond System-level access on a wide range of MediaTek mobile chipsets. Exploitation is constrained to attackers who have already obtained System privileges, making this a secondary step in a multi-stage attack chain rather than an initial foothold technique. No public exploit code exists and EPSS of 0.13% (3rd percentile) confirms negligible real-world exploitation activity; no CISA KEV listing at time of analysis.
Heap buffer overflow in the MediaTek Audio HAL enables a local attacker with user-level privileges to crash the audio subsystem, resulting in a denial of service condition on affected devices. Seven MediaTek chipsets across mobile and automotive platforms are affected, with MediaTek releasing two separate patch IDs addressing the flaw in its August 2026 security bulletin. EPSS at 0.15% (5th percentile), no KEV listing, and a CISA SSVC exploitation status of 'none' collectively indicate negligible real-world exploitation risk at time of analysis; no public exploit code has been identified.
Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.
Out-of-bounds read in the Windows Encrypting File System (EFS) driver exposes sensitive memory contents to any locally authenticated attacker holding standard user privileges. Affected systems span the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the patch surface extremely broad. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the combination of a low-complexity local attack and high confidentiality impact warrants prompt patching on systems where EFS is actively used.
Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows (Ring 2: Device Drivers) enables a denial-of-service condition exploitable from adjacent network position without authentication. The memory corruption flaw in the Windows WiFi driver stack can be triggered with passive user interaction, causing high availability impact to the vulnerable system and a residual low availability impact to subsequently connected systems. No public exploit code has been identified at time of analysis, and Intel has published advisory INTEL-SA-01422 addressing this issue.
Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Out-of-bounds read and conditional write in Vim 9.2.0469 through 9.2.0842 can be triggered when a text-property-anchored popup window is configured with both clipwindow and opacity settings active. The defect in `popup_mark_opacity_zindex()` (src/popupwin.c) fails to account for `w_popup_topoff` when `w_winrow` is negative, causing the function to index before the start of the screen array - a classic buffer underwrite (CWE-124). Real-world impact is constrained by the local attack vector, mandatory user interaction, and non-default feature combination required; no public exploit or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Vim's socket server backend prior to version 9.2.0842 allows a local process with access to the Vim server socket to corrupt stack memory or crash the Vim server by flooding it with client connections. The unbounded accept loop in socketserver_accept() causes file descriptors to exceed the compile-time bounds of fd_set structures and struct pollfd arrays allocated on the stack in src/channel.c and src/os_unix.c. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operating from an adjacent network, to trigger unauthorized modifications to router firmware and core functionality beyond what the admin interface normally permits. Affected hardware spans at least 19 model variants including RAX20, RAX35V2, RAX41/V2, RAX42/V2, RAX43/V2, RAX45, RAX49S, RAX50, RAXE450, RAXE500, XR1000, and XR1000V2. No public exploit code has been identified and this CVE is absent from CISA KEV; a vendor-released patch is available from NETGEAR for affected models.
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin user on an adjacent network to make unauthorized modifications to the router's software and functionality. Exploitation is highly constrained by CVSS 4.0 metrics - adjacent network access, high attack complexity, and pre-existing administrative credentials are all required, yielding an extremely low composite score of 1.9. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing real-world risk well below what the CWE-121 classification alone might suggest.
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authenticated administrator with adjacent network access to crash affected devices, causing temporary service unavailability. Affected hardware spans the MR, MS, and RAX product lines across at least 15 models and carries a CVSS 4.0 score of 1.1, reflecting the high-privilege prerequisite and narrow impact scope limited to transient availability loss. No public exploits exist and no active exploitation has been reported; vendor firmware patches are available through NETGEAR per-product support pages.
Stack-based buffer overflow across ten NETGEAR RAX-series WiFi 6 routers allows a device administrator with adjacent network access to temporarily disrupt normal device operation, producing a transient denial-of-service. The vulnerability carries a CVSS 4.0 score of 1.1, reflecting its highly constrained attack conditions: high-privilege access and adjacent network adjacency are both required, and the only impact is a brief availability disruption with no confidentiality or integrity consequence. No public exploit code exists and the vulnerability is not listed in CISA KEV; NETGEAR has released firmware patches for all affected models.
Heap out-of-bounds read in Tesseract OCR prior to version 5.5.3 allows an attacker who can supply a crafted .traineddata model file to crash the OCR process before any image processing occurs. The flaw in SquishedDawg::read_squished_dawg accepts unterminated forward-edge runs, after which num_forward_edges(0) causes last_edge to read beyond the edges_ heap buffer - triggering a process crash. No public exploit has been identified at time of analysis; vendor-released patch version 5.5.3 is available and the fix is confirmed by PR #4581 and the GitHub release tag.
Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file that causes a signed integer multiplication overflow in Convolve::DeSerialize, undersizing the forward-pass output buffer while write operations use the original unwrapped element count. Any application or user that loads an attacker-controlled model file is exposed to memory corruption that can lead to arbitrary code execution or process crash in the context of the OCR engine. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and a vendor-confirmed fix is available in Tesseract 5.5.3.
Velociraptor's NTFS parsing library contains out-of-bounds read and memory exhaustion flaws that allow a crash and denial of service when processing maliciously crafted NTFS images. All versions of Rapid7's Velociraptor (cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) are affected, with meaningful exposure limited to dead disk forensics workflows where untrusted NTFS images are ingested - live filesystem analysis is largely insulated from this attack path. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the local attack vector further constrains real-world exploitation opportunity.
Out-of-bounds heap write in Zephyr RTOS's USB device-next CDC NCM class handler allows any physical USB host to corrupt the device's shared network buffer pool by issuing standard GET_NTB_PARAMETERS or GET_NTB_INPUT_SIZE control requests with a wLength field smaller than the response structure size. The overflow is bounded at up to 27 bytes and writes only fixed device constants, making its primary impact denial of service of the USB stack rather than arbitrary code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, exploitation requires only physical USB access to a device built with the opt-in device_next stack and CDC NCM class.
Buffer overflow in Axis Communications' Signed Video Framework crashes applications that use its signed content validation tooling. Specifically, the Signed Media Verifier and Axis File Player are affected when processing maliciously crafted signed video content, while the AXIS OS device-side signed video functionality remains entirely unaffected. No public exploit code has been identified at time of analysis, and with CVSS 5.3 (Medium), the impact is limited to availability loss - a crash of the validation application - with no confidentiality or integrity consequences.
NULL pointer dereference in Zephyr RTOS's experimental device_next USB DFU class crashes any device where DFU download is enabled when a USB host sends a zero-length DFU_DNLOAD terminator after initiating a valid transfer. The result is a fatal CPU fault causing device crash or reset - impact is strictly limited to availability, with the vendor and commit diff explicitly confirming no memory corruption or information disclosure. No public exploit has been identified at time of analysis, and exploitation requires physical control of the attached USB host.
Double-free corruption in Zephyr RTOS's Bouffalo Lab BLE HCI driver crashes the BLE stack on any device using a BL60x/BL70x/BL61x on-chip controller. The driver's bt_bflb_send() unconditionally consumed a net_buf reference on all error paths via a shared 'done' label, violating the bt_hci_driver_api contract that reserves unref responsibility for the caller on failure; the subsequent caller-side unref then double-decrements the reference count, prematurely freeing a parent TX buffer that remains reachable on the connection queue and corrupting the shared net_buf pool. No public exploit identified at time of analysis; EPSS data was not supplied, and CISA KEV listing is absent.
Double-free (CWE-415) and use-after-free read (CWE-416) vulnerabilities in the Realtek BEE Bluetooth HCI driver within Zephyr RTOS expose affected devices to memory pool corruption and likely crashes when an adjacent Bluetooth peer drives heavy transmit activity toward resource-exhaustion error conditions. The bt_hci_bee_send() function in hci_bee.c violated the bt_hci_driver_api buffer-ownership contract by routing all error exits through a shared cleanup label that unconditionally called net_buf_unref(), while the Zephyr host TX path also unrefs the buffer on error return - resulting in a double free of the same net_buf and a subsequent read of freed memory via a LOG_ERR call compiled in at the default error log level. An upstream fix is confirmed via Zephyr project commit 9a684b5c314fb1d8670b01f7b6c4450a9353906c; no formally released patched version has been independently confirmed, and no public exploit has been identified at the time of this analysis.
Stack-based buffer overflow in SAP SAPSPrint Service (CWE-121) allows unauthenticated remote attackers to crash the service via specially crafted command requests, triggering an automatic service restart. The impact is limited to low availability disruption with no confidentiality or integrity compromise. No public exploit code or active exploitation has been identified at time of analysis, and SAP has addressed this vulnerability via their Security Patch Day cycle.
Concurrent access to an unprotected singleton context structure in Zephyr RTOS's UpdateHub OTA subsystem enables two independent callers - the background autohandler and user-triggered update operations - to race through prepare_fds(), producing an out-of-bounds write that corrupts adjacent struct members and disables the firmware-update path. Affected are embedded systems running Zephyr with the UpdateHub subsystem enabled, particularly those built with CONFIG_USERSPACE where unprivileged userspace threads can invoke update syscalls and actively compete with the workqueue handler. No public exploit has been identified at time of analysis, the CVSS base score is 2.5, and the vendor commit confirms no demonstrated path to code execution - impact is limited to availability of the OTA update mechanism.
Out-of-bounds memory copy in QEMU's vhost inflight migration VMState handler allows a privileged attacker with control of the migration channel to crash the destination QEMU process or corrupt heap memory. The root cause is a numeric type mismatch - the inflight buffer size is stored as uint64_t but deserialized by the VMS_VBUFFER load path as signed int32_t, so a crafted value with bit 31 set wraps to a massive size_t, causing qemu_get_buffer() to read far beyond the mmap-backed inflight region. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 4.4 reflects the realistic high-privilege barrier to exploitation.
Uninitialized-memory and out-of-bounds read in the UpdateHub OTA client of Zephyr RTOS allows a malicious or on-path UpdateHub server to crash the device update thread via a crafted probe response, producing a network-triggerable denial of service. The flaw exists in z_impl_updatehub_probe() within subsys/mgmt/updatehub/updatehub.c, where metadata_copy is allocated with k_malloc (leaving heap unzeroed) and filled via memcpy without a NUL terminator; a subsequent strlen() then scans into uninitialized heap, producing an over-long length fed to json_obj_parse(). No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but it is remotely triggerable against Zephyr devices running UpdateHub without DTLS transport protection.
Stack clash vulnerability in glibc's wordexp() function allows remote attackers to exhaust thread stack space via a crafted tilde-expanded path argument. The parse_tilde internal function uses strndupa - a GNU macro that allocates directly on the stack - to extract a username from attacker-controlled input, with no bounds check on the allocation size. Any application that passes untrusted input to wordexp() is a viable exploitation vector, making the real-world impact contingent on calling application patterns rather than glibc defaults alone. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 6.6 reflects high attack complexity due to the application-dependency prerequisite.
Heap buffer overflow in entr's run_utility() function allows a local low-privileged user to trigger memory corruption, process abort, and denial of service by supplying crafted command-line arguments or by using the slash-underscore substitution feature, which expands a short token into a longer pathname at runtime. The flaw stems from incorrect use of strlcpy()'s return value - which reflects the total source length rather than bytes written - to advance a destination pointer, causing an unsigned size_t underflow in the remaining-buffer counter and subsequent out-of-bounds heap writes. No public exploit has been identified and this vulnerability is absent from CISA KEV; an upstream fix is available via commit 2467fe0.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow. Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rx_stream failover path The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic. Limit the copy size to the missing byte count. [Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one. uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly. Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation: BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60) Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.
In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() dmar_latency_disable() intends to zero out only the single latency_statistic entry for the given type, but the memset size was computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire array starting from &lstat[type]. When type > 0, this writes beyond the end of the allocated array, corrupting adjacent memory. Fix by using sizeof(*lstat) to clear only the target entry.
In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern. Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0 Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is 0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a kernel page fault. The IB only needs to be a minimal NOP shell to schedule the job; the cleaner shader itself is emitted on the ring via emit_cleaner_shader(). Fill 16 dwords to match the allocation. v2: Use ib_size_dw variable (Lijo) (cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the values for height and stride are large. Fix the issue by multiplying with mul_u32_u32().
In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmc_ioctl_cdrom_volume() first reads the audio control mode page into a 32-byte stack buffer with cgc->buflen set to 24. If the device reports a block descriptor, the function increases cgc->buflen to include that descriptor and reads the page again. For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list by moving cgc->buffer forward by offset - 8 bytes. This drops the block descriptor from the outgoing payload and leaves a new 8-byte mode parameter header in front of the audio control page. However, cgc->buflen is left unchanged. With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8 but cgc->buflen remains 32. cdrom_mode_select() therefore asks the low level packet path to write 32 bytes from that adjusted pointer, reading 8 bytes past the end of the 32-byte stack buffer. This is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on drives that return a non-zero block descriptor length, which helps explain why it has gone unnoticed. The overread is also sent to the device as extra MODE SELECT payload, so it may not produce an obvious local failure. Reduce cgc->buflen by the same amount as the buffer pointer adjustment so the MODE SELECT transfer covers only the intended parameter list.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl(): pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size); This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself. Restore *size to its pre-addition value on each overflow branch (via `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed. The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).
Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream.
Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.
GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed.
Out-of-bounds memory write in the VC1 codec implementation within libsavsvc.so on Samsung Mobile Devices exposes affected handsets to local memory corruption with limited but confirmed multi-property impact. Devices running Samsung firmware prior to SMR Aug-2026 Release 1 are vulnerable, with the flaw addressable by updating to the August 2026 Samsung Monthly Release. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds memory write in Samsung Mobile Devices' MPEG4 codec library libsavsvc.so enables local attackers with no special privileges to corrupt memory, potentially leading to code execution or service disruption across affected system components. All Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1 are exposed via this improper input validation flaw in the proprietary media codec. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for exploitation on any affected device with an unprivileged app installed.
Out-of-bounds memory write in Samsung's VC1 codec library libsavsvc.so allows local attackers to corrupt process memory on affected Samsung mobile devices. The root cause is an incorrect numeric type conversion during VC1 video decoding, a class of error that can produce exploitable integer truncation or overflow conditions leading to heap or stack corruption. No public exploit code has been identified at time of analysis, and the vendor has addressed this in the SMR Aug-2026 Release 1 security update.
Out-of-bounds memory write in libsmsd.so affects all Samsung Mobile Devices running firmware prior to SMR Aug-2026 Release 1, exploitable by a local unprivileged attacker with no special privileges required. The flaw in Samsung's SMS daemon shared library allows memory corruption that could destabilize the smsd process or, with additional technique, enable code execution within the daemon's privilege context. No public exploit identified at time of analysis, and no CISA KEV listing; however, low attack complexity combined with zero privilege requirements makes this actionable for any malicious app or shell-level actor on an unpatched device.
Out-of-bounds memory write in Samsung's libcodec2_sec_flacdec.so FLAC decoder library exposes Samsung Mobile Devices to local exploitation on firmware prior to the SMR Aug-2026 Release 1 patch. The root cause is improper input validation in the secure FLAC decoding component, allowing a local attacker to write beyond allocated memory boundaries and potentially corrupt adjacent memory. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.
Out-of-bounds write in Samsung's libcodec2secqcelpdec.so QCELP audio codec decoder library allows local attackers holding low-privilege execution on affected Samsung devices to corrupt adjacent memory regions, with limited confidentiality, integrity, and availability impact confined to the vulnerable system. The flaw is addressed in SMR Aug-2026 Release 1, Samsung's August 2026 Security Maintenance Release covering all prior unpatched firmware builds. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.4 reflects the strictly local attack surface and bounded impact scope.
Infinite-loop denial-of-service in libexpat before 2.8.3 allows attackers supplying crafted UTF-16 XML to hang the parsing process indefinitely via a low Unicode surrogate handled as a high surrogate in the *_toUtf16 functions. The flaw is gated by a compile-time prerequisite - only builds configured with XML_UNICODE and XML_UNICODE_WCHAR_T are vulnerable - which specifically includes Firefox and Windows-native builds of applications embedding libexpat. A concrete attack payload is publicly available in the upstream patch PR test suite; no active exploitation has been confirmed via CISA KEV at time of analysis.
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows a local attacker with low privileges to corrupt heap memory by supplying a crafted GetNamedVariableListAttributesResponse itemId argument to the MmsMapping_varAccessSpecToObjectReference function in the MMS Protocol Workflow. A public proof-of-concept exploit has been released and is available for download. The vulnerability has not yet been patched; the project was notified via GitHub issue #599 but has not responded at time of analysis. No active exploitation is confirmed by CISA KEV, though the publicly available PoC meaningfully elevates near-term risk.
Out-of-bounds memory read and write in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver allows a low-privileged thread, when explicitly granted flash device access in a CONFIG_USERSPACE build, to disclose arbitrary CPU-addressable memory or corrupt flash and invalidate cache beyond the mapped flash window. The root cause is a signed/unsigned type confusion in the offset bounds check: a crafted negative off_t value converts to a large unsigned integer and the subsequent addition wraps to a small result that passes the check, allowing memcpy to read from or program flash at attacker-controlled addresses. No public exploit code has been identified at time of analysis; exploitation is nonetheless mechanically straightforward for any attacker familiar with signed/unsigned integer confusion vulnerabilities.
Out-of-bounds kernel memory read in SonicWall Global VPN Client's SWIPsec.sys driver allows a local, low-privileged attacker to crash the host system. Affected versions are 4.10.8.1108 and earlier, running on Windows where the IPsec kernel driver is loaded by the VPN client. No public exploit identified at time of analysis, and EPSS probability stands at a very low 0.16% (5th percentile), indicating no signs of active or widespread exploitation interest.
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows an attacker on the adjacent IEC 61850 SV network segment to corrupt process memory by injecting malformed Sampled Values ASDU packets into the SVReceiver. The commit diff confirms that the parseASDU function in SVReceiver_stopThreadless assigned heap pointers for ASDU fields-svId, datSet, SmpCnt, ConfRev, RefrTm, SmpSynch, SmpRate, and SmpMod-without validating their lengths, enabling overflow via crafted field sizes. A public exploit has been released (E:P per CVSS 4.0 supplemental data); this vulnerability is not currently listed in CISA KEV but poses targeted risk to IEC 61850 substation automation and power grid environments.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap out-of-bounds write in RadiAnt DICOM Viewer is triggered when processing JPEG-compressed pixel data embedded in a crafted DICOM file, potentially enabling arbitrary code execution on the victim's workstation. Reported to CISA ICS-CERT as a medical device advisory (ICSMA-26-218-01), the vulnerability requires no privileges and only passive user interaction - consistent with file-preview or file-open workflows common in clinical imaging environments. The provided CVSS 4.0 score of 5.3 rates impact as availability-only (VA:L), which conflicts materially with the described RCE potential; this discrepancy is significant and should be independently verified. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Out-of-Bounds Read in Autodesk's image handling library crashes Revit and AutoCAD when a user opens a maliciously crafted TIF file during image import. Affected products span Revit 2024, 2026, and 2027 as well as AutoCAD and AutoCAD LT 2027, all below vendor-specified fix versions. The attack is local and requires user interaction, limiting automated mass exploitation, but remains a viable denial-of-service vector in targeted scenarios against AEC professionals who routinely handle externally sourced CAD assets. No public exploit identified at time of analysis.
Out-of-bounds heap read in llama.cpp's recurrent memory state restore path (builds b5702 through b7653) allows an attacker with write access to the slot save directory to craft a malicious slot file that triggers heap data leakage - including pointer values - into server logs, effectively defeating ASLR protections and enabling multi-stage exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalogue. An upstream fix is available as a commit to the ggml-org/llama.cpp repository, though a tagged released version past the affected build range has not been independently confirmed.
Use-after-free in MZ Automation libiec61850 up to version 1.6.1 allows a local low-privileged attacker to corrupt memory through the URCB (Unbuffered Report Control Block) dataset shadow buffer deletion path. The vulnerability exists in `deleteDataSetValuesShadowBuffer` within `reporting.c`, where the function dereferenced `self->dataSet` to compute its size after that pointer could already have been freed or set to NULL during connection teardown. A publicly available proof-of-concept exists, though no active exploitation has been confirmed via CISA KEV. The fix, released in v1.6.2 (commit 486fd57f), stores buffer size independently and adds semaphore locking to prevent the race.
Out-of-bounds heap read in the node-re2 npm package (versions <= 1.26.0) exposes up to 3 bytes of adjacent heap memory per call to JavaScript when Buffer arguments ending in a truncated multi-byte UTF-8 lead byte are passed to replace() or split(). The overread is deterministic, requires no heap grooming, and a working proof-of-concept is included in the GitHub advisory. Applications that pass only strings - not Buffers - are entirely unaffected, but those that process untrusted Buffer input through re2 are at real risk of incremental heap disclosure. No CISA KEV listing was identified; this is a library-layer flaw fixed in re2@1.26.1.
Stack buffer overrun in SecureAge CatchPulse allows a local low-privileged attacker to crash the application, producing a denial-of-service condition. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only an authenticated local session with no user interaction, making it viable for insider threats or post-compromise lateral DoS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stack-based buffer overflow in ELAN Smart-Pad Windows kernel drivers ETD.sys and ETDSMBus.sys allows a local standard-privilege user to crash the entire Windows system via a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER). The vulnerability is rooted in the Intel SMBus recovery code path: ETDSMBus.sys accepts a hardware-derived report count without enforcing an upper bound and forwards it to ETD.sys, where it drives an unbounded stack buffer copy. A proof-of-concept exists (CVSS 4.0 E:P) and no confirmed patch version has been identified from available data; no active exploitation is listed in CISA KEV at time of analysis.
Integer underflow in HDF5 through 2.3.0 allows denial of service when processing Fletcher32-filtered datasets with chunk sizes smaller than 4 bytes. The `H5Z__filter_fletcher32` function in `H5Zfletcher32.c` subtracts the 4-byte checksum length from the input buffer size using an unsigned `size_t` without first verifying the buffer meets the minimum size, causing the result to wrap near `SIZE_MAX` and triggering a massively out-of-bounds read inside `H5_checksum_fletcher32`. Any application or pipeline calling `H5Dread` on a crafted HDF5 file - including the standard `h5ls` and `h5dump` utilities - can be crashed; no public exploit code has been identified and this vulnerability is not in CISA KEV.
Out-of-bounds heap read in HDF5's N-Bit filter decompression affects all versions through 2.3.0, allowing an attacker who can deliver a crafted HDF5 file to a user or automated pipeline to trigger application crashes and, in constrained cases, leak adjacent heap memory contents into decompressed dataset values. The three affected functions - H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic - advance a buffer read index without bounding it against the actual compressed chunk size, exploitable whenever H5Dread is invoked, including via common tools like h5ls and h5repack. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.
Out-of-bounds memory read in Electron's offscreen rendering pipeline allows a compromised GPU process to cause the browser/main process to read beyond a shared memory mapping boundary when producing `paint` event images, disclosing process memory or crashing the application. Exploitation requires two independent preconditions: the host application must enable `webPreferences.offscreen` (non-default) and an attacker must have already achieved code execution in the GPU process via a separate vulnerability. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it). Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop. BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Out-of-bounds read in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows unauthenticated remote attackers to trigger memory over-reads in the multipart SIP body parser by sending a crafted message with Content-Type: multipart/mixed whose body contains "--" within two to three bytes of the buffer end. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-prerequisite exploitation with low availability impact, though the reporter's "Information Disclosure" tag conflicts with the official C:N rating, suggesting potential memory leakage beyond what the score reflects. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are confirmed in 3.6.6 and 4.0.0-rc1.
Persistent denial of service in dhcp-server (dhcpd) on Red Hat Enterprise Linux 6 through 9 is triggered via a crafted OMAPI lease creation request containing an overly long InfiniBand MAC address, overflowing a buffer in `print_hw_addr()` and crashing the dhcpd daemon in a way that prevents automatic recovery. The official CVSS score of 4.9 with PR:H reflects the assumption that TSIG authentication guards the OMAPI port; however, the description explicitly highlights that TSIG is optional and often absent, reducing the realistic exploitation barrier to unauthenticated network access. No confirmed active exploitation (KEV) or public proof-of-concept exists at time of analysis.
Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the OPC-UA client process by triggering a memory read violation in the DeleteMonitoredItemsRequest handler state machine function. The flaw is confined to the client-side wrapper component and results in an availability impact rather than code execution or data exfiltration. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to coordinated disclosure, leaving no official patch confirmed at time of analysis.
Heap-based buffer overflow in open62541 up to version 1.5.5 allows local low-privileged attackers to corrupt heap memory via the UA_Client_readNodeClassAttribute function in the client high-level API. The vulnerability is confined to local exploitation (AV:L/PR:L), limiting its network attack surface, but publicly available exploit code lowers the barrier for abuse on compromised or multi-tenant systems running open62541 OPC UA clients. The open62541 project closed the issue report as filed through unofficial channels, leaving patch status and official acknowledgment unconfirmed.
Memory corruption in Qualcomm Snapdragon's registry value processing exposes devices to potential code execution by high-privileged local attackers. The flaw, rooted in CWE-120 (classic buffer overflow), is triggered when a direct query method processes registry values supplied with incorrect types - bypassing proper type-length validation and corrupting adjacent memory. While the full C:H/I:H/A:H impact triad indicates serious consequences if reached, the PR:H (high privilege) and AV:L (local) CVSS metrics substantially narrow the realistic attack surface. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N confirms the attack is network-reachable with no authentication or complexity barriers.
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() The `ims_pcu_process_data()` processes incoming URB data byte by byte. However, it fails to check if the `read_pos` index exceeds IMS_PCU_BUF_SIZE. If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE, `read_pos` will increment indefinitely. Moreover, since `read_pos` is located immediately after `read_buf`, the attacker can overwrite `read_pos` itself to arbitrarily control the index. This manipulated `read_pos` is subsequently used in `ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a heap buffer overflow. Specifically, an attacker can overwrite the `cmd_done.wait.head` located at offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`. Consequently, when the driver calls `complete(&pcu->cmd_done)`, it triggers a control flow hijack by using the manipulated pointer. Fix this by adding a bounds check for `read_pos` before writing to `read_buf`. If the packet is too long, discard it, log a warning, and reset the parser state. [dtor: factor out resetting packet state, reset checksum as well]
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote attackers to crash the NAS service on eleven router models running firmware up to 20260707, resulting in a denial of service. The vendor confirmed the vulnerability following responsible disclosure, and the GitHub advisory explicitly identifies the impact as authenticated denial of service with no confidentiality or integrity compromise. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds read in mz-automation libiec61850 up to version 1.6.1 allows remote unauthenticated attackers to crash the IEC 61850 MMS server process and potentially leak heap or stack memory contents by sending a crafted MMS DataSet access request. The root cause is unconstrained string copy operations in the checkDataSetAccess function, now confirmed fixed in v1.6.2 via bounded copy with a 129-byte limit. A public exploit has been disclosed; however, this vulnerability is not listed in CISA KEV and the CVSS 4.0 score of 6.9 (Medium) reflects limited impact scope confined to availability of the vulnerable system.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Stack-based buffer overflow in GIMP's file-png plugin on Red Hat Enterprise Linux 6 through 9 causes the application to crash when a user opens a crafted Animated PNG (APNG) image containing an oversized tRNS chunk, resulting in a Denial of Service limited to the affected user session. Exploitation requires local file access and active user interaction - a remote attacker would rely on social engineering (phishing, malicious download) to deliver the file. No active exploitation has been confirmed by CISA KEV, no public exploit code is identified at time of analysis, and EPSS data is unavailable in source intelligence.
Out-of-bounds read in MediaTek's GeniZone trusted execution environment (TEE) exposes memory on 17 affected chipset models to local information disclosure, but only after an attacker has already acquired System-level privilege. The vulnerability stems from a missing bounds check in the geniezone driver (CWE-125, Patch ID ALPS11036877), and is tracked by MediaTek as MSV-7132. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.14% (4th percentile) and SSVC exploitation status of 'none', this is a low-urgency finding despite the breadth of affected silicon.
Out-of-bounds read in the MediaTek Wi-Fi driver component on MT6988, MT6990, and MT6890 chipsets permits local information disclosure against devices where an attacker has already obtained System-level privilege. The missing bounds check in the Wi-Fi stack allows reading memory beyond the intended buffer boundary, exposing potentially sensitive kernel or driver memory contents. No public exploit exists and EPSS at 0.13% (3rd percentile) reflects the significant privilege prerequisite that constrains real-world exploitation; CISA KEV does not list this vulnerability.
Out-of-bounds write in the wifi subsystem of MediaTek MT6890, MT6990, and MT6988 chipsets enables a local denial of service, crashing the wifi component or device. Exploitation requires that the attacker has already obtained System-level privilege on the affected device - an extremely high bar that makes this a post-exploitation nuisance rather than an initial access vector. EPSS sits at 0.13% (3rd percentile), no public exploit code exists, and the vulnerability is not listed in the CISA KEV catalog, all consistent with the substantial privilege prerequisite.
Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.
Out-of-bounds read in MediaTek's ccci (Cross Core Communication Interface) driver on multiple chipsets enables local denial of service by a System-privileged attacker. Affected chipsets include MT6813, MT6988, MT6982VB, MT6986D, and MT6986 - targeting mid-range and flagship Android SoC lines. No public exploit code exists and CISA has not added this to KEV; real-world impact is constrained by the high privilege prerequisite, making this a post-compromise availability risk rather than an initial access vector.
Local information disclosure in the display subsystem of multiple MediaTek SoC chipsets results from a CWE-125 out-of-bounds read triggered by an integer overflow. Seventeen distinct chipsets are confirmed affected per the EUVD listing, spanning devices such as MT8910, MT8188, MT8768, and MT6991 - all prevalent in mid-range and budget Android hardware. Exploitation requires an attacker who has already attained System-level privilege on the device; no public exploit exists and EPSS sits at 0.14% (4th percentile), consistent with the SSVC exploitation rating of 'none'.
Local information disclosure in MediaTek's display subsystem exposes arbitrary kernel memory to a privileged local process due to a missing bounds check (CWE-125). Exploitation is limited to actors who have already obtained System-level privileges on a device running one of 17 affected MediaTek chipsets (MT6991, MT8676, MT8799, and others). No public exploit code and no active exploitation have been identified; EPSS sits at 0.14% (4th percentile), consistent with SSVC's 'none' exploitation status and 'no automatable' classification.
Out-of-bounds write in MediaTek's HFRP component on the MT6993 chipset enables local privilege escalation beyond System-level access, confirmed via MediaTek's August 2026 security bulletin. The flaw stems from a missing bounds check (CWE-787), requiring an attacker who has already achieved System privilege to trigger further escalation - a post-compromise lateral movement primitive rather than an initial access vector. No public exploit code and no KEV listing have been identified; EPSS sits at the 3rd percentile, consistent with SSVC's 'exploitation: none' finding.
Out-of-bounds write in MediaTek's GeniZone Trusted Execution Environment (TEE) component enables local privilege escalation across 14 distinct MediaTek chipsets. An attacker who has already achieved System-level privilege on an affected Android device can exploit a missing bounds check to write outside intended memory boundaries within the secure enclave, gaining confidentiality and integrity access beyond what System privilege normally permits. No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability; however, the pre-existing System privilege prerequisite substantially narrows the realistic attack surface.
Out-of-bounds write in MediaTek's GenieZone hypervisor component enables local privilege escalation beyond System-level access on a wide range of MediaTek mobile chipsets. Exploitation is constrained to attackers who have already obtained System privileges, making this a secondary step in a multi-stage attack chain rather than an initial foothold technique. No public exploit code exists and EPSS of 0.13% (3rd percentile) confirms negligible real-world exploitation activity; no CISA KEV listing at time of analysis.
Heap buffer overflow in the MediaTek Audio HAL enables a local attacker with user-level privileges to crash the audio subsystem, resulting in a denial of service condition on affected devices. Seven MediaTek chipsets across mobile and automotive platforms are affected, with MediaTek releasing two separate patch IDs addressing the flaw in its August 2026 security bulletin. EPSS at 0.15% (5th percentile), no KEV listing, and a CISA SSVC exploitation status of 'none' collectively indicate negligible real-world exploitation risk at time of analysis; no public exploit code has been identified.
Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.