Buffer Overflow
Monthly
Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.
Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.
Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'
Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.
Out-of-bounds write in MediaTek's Trusted Firmware-A (TFA) component allows a local attacker already holding System-level privilege to crash the device, causing a denial of service. Affected hardware includes MediaTek Dimensity and Helio chipsets MT6986D, MT6986, and MT6982VB. No public exploit code has been identified and CISA KEV does not list this vulnerability, consistent with its low EPSS score of 0.14% and SSVC exploitation status of none.
Out-of-bounds write in the MediaTek Download Agent (DA) firmware component across eight chipset families allows an attacker with physical device access to trigger a local denial of service by sending a crafted payload while the device is in DA mode. Affected chipsets span mobile SoCs (MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) and modem/automotive chipsets (MT2735, MT2737), broadening the potential device footprint across Android smartphones and connected vehicle platforms. No public exploit code exists, EPSS sits at the 6th percentile (0.16%), SSVC confirms no known exploitation, and the physical access prerequisite fundamentally constrains real-world risk.
Local privilege escalation in MediaTek's apusys AI Processing Unit subsystem on MT8196 and MT8366 chipsets allows an attacker already holding System-level privileges to further escalate by exploiting a confused deputy flaw - likely realized through an out-of-bounds write (CWE-787) - achieving high confidentiality and integrity impact on the vulnerable system. Disclosed by MediaTek in their August 2026 Product Security Bulletin, a vendor patch is available under Patch ID AUTO00833804. No public exploit has been identified at time of analysis, and an EPSS of 0.14% at the 4th percentile reflects negligible probability of widespread exploitation.
Secure boot heap buffer overflow in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990 enables local privilege escalation by an attacker with physical device access. The vulnerability exists at the pre-OS firmware layer, where a write beyond allocated heap boundaries can corrupt boot verification logic and permit execution of unsigned or attacker-controlled code. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.16% (6th percentile) is consistent with the hard physical access prerequisite sharply limiting opportunistic exploitation.
Out-of-bounds write in the MediaTek HEVC video decoder enables further privilege escalation on devices running MT6761, MT8766, and MT8768 chipsets. The flaw, rooted in an integer overflow during HEVC bitstream processing, can be triggered without user interaction but only by an actor who already holds System-level privilege on the device. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment - though SSVC rates Technical Impact as total, reflecting the severity of what a successful second-stage exploit could achieve.
Stack-based buffer overflow in OreSat Firmware v1.0 allows an attacker with physical access to the UART3 serial interface to crash the firmware by sending a crafted `edl fw_flash` command with an oversized filename argument. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms impact is strictly limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code exists and no active exploitation has been identified; an EPSS score of 0.14% at the 4th percentile corroborates negligible automated exploitation probability.
Out-of-bounds heap read in FreeRDP's UVC H.264 extension-unit parser affects all versions prior to 3.29.0, allowing an attacker with physical USB access to trigger denial of service during camera stream setup. The parser fails to validate descriptor length before accessing the GUID field, enabling a read beyond allocated heap bounds when a malicious USB video camera is connected. No public exploit has been identified, KEV listing is absent, and the CVSS 4.0 score of 2.4 accurately reflects the constrained physical-access attack surface.
Out-of-bounds read in FreeRDP 3.28.0 and earlier allows a malicious or compromised RDP server to leak client-side memory contents or crash the FreeRDP process by sending a crafted truncated planar-encoded bitmap or surface update. The flaw lives in the RDP6 planar RLE decoder (libfreerdp/codec/planar.c), where attacker-declared raw byte counts of 0-15 bytes following a bounds-checked control byte are consumed without verifying remaining buffer space. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; FreeRDP 3.29.0 contains the confirmed vendor patch.
Out-of-bounds read in Zephyr RTOS DHCPv4 client (versions 1.7.0 through 4.4.x) allows an adjacent-network attacker to crash the DHCP client or leak adjacent pointer contents by sending a crafted DHCP reply with a message-type value greater than 8. The defect is a classic sizeof-vs-ARRAY_SIZE confusion: the bounds guard compares a raw msg_type byte against the byte-size of a pointer array (32 or 64, depending on architecture) rather than its element count of 8, so values 9-31/63 bypass the check and cause a wild-pointer dereference inside a debug log call. Exploitation is gated on a non-default build configuration (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), substantially reducing the real-world attack surface. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Buffer overflow in NTPsec's Zyfer refclock driver crashes the ntpd daemon on affected systems running versions prior to 1.2.5. A local, low-privileged attacker with high attack complexity can trigger the CWE-120 classic buffer overflow, resulting in a denial-of-service impact limited to availability - no confidentiality or integrity exposure exists. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5.
Out-of-bounds read in mz-automation/lib60870 allows unauthenticated remote attackers to leak one byte of heap memory and potentially crash the parsing process by sending a crafted IEC 60870-5-104 I-frame. The vulnerability triggers when a declared ASDU object count exceeds the actual data present in the message buffer, causing `InformationObject_ParseObjectAddress` to read one byte beyond the allocated heap region. Disclosed via CISA ICS Advisory ICSA-26-211-11 with no public exploit identified at time of analysis.
Out-of-bounds heap read in mz-automation's lib60870 library exposes ICS/SCADA systems to unauthenticated remote exploitation via a crafted IEC 60870-5-104 I-frame. An attacker sending a C_TS_NA_1 ASDU with an inflated object count triggers `TestCommand_getFromBuffer` to read one byte past the end of a heap-allocated buffer, producing partial heap memory disclosure and potential availability disruption. CISA ICS-CERT has published advisory ICSA-26-211-11; no active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Denial-of-service in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an adjacent unauthenticated attacker to crash the MMS server process by sending a crafted BER-encoded confirmed request PDU containing an extended BER tag over an established MMS session. The missing bounds check in the buffer decoder causes a one-byte heap out-of-bounds read, terminating the MMS service and disrupting IEC 61850-based industrial control communications. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Out-of-bounds heap read in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an unauthenticated adjacent-network attacker to crash an MMS server by sending a crafted AARQ PDU with a zero or one-byte length value in the calling AP title field during connection establishment. The ACSE parser fails to bounds-check the attacker-controlled length, reading past the end of a heap buffer and causing availability loss - a significant concern in IEC 61850 substation automation environments where device availability underpins grid protection and monitoring. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; a vendor patch (version 1.6.2) is available per CISA ICS advisory ICSA-26-211-10.
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately 4 KB beyond a heap allocation and conditionally crash the analyzer by embedding a crafted User-Agent string into any web server access log that GoAccess subsequently processes. The defect resides in the parse_ios() function (src/opesys.c), where an attacker-controlled keyword-to-OS offset value is incorrectly passed as both the source pointer offset and the copy length to memmove(), violating the intended semantics and enabling the out-of-bounds read. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in version 1.11.
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Stack exhaustion in PHP's phar archive handler allows an attacker to crash the PHP process by supplying a crafted archive containing circular symbolic links, triggering unbounded recursion that depletes the native C stack. Affected versions span PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9 across all platforms. Exploitation requires a PHP process to actively parse the malicious archive (UI:A/AV:L); no public exploit has been identified and exploitation likelihood is rated unlikely (E:U in the provided CVSS 4.0 vector), making this a moderate-priority patch for most deployments - with heightened urgency for applications that process user-supplied phar archives.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Heap-based buffer overflow in Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by physically present, unauthenticated attackers via malformed USB packets. The device's USB packet handler copies attacker-controlled data into a fixed-length heap buffer without validating input length, allowing full control of device execution context. Reported by Zero Day Initiative (ZDI-CAN-29048 / ZDI-26-436); no public exploit code identified at time of analysis and not listed in CISA KEV.
Stack-based buffer overflow in the NFC card response handler of Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by a physically present attacker. The device's NFC interface fails to enforce bounds on a fixed-length stack buffer when processing card responses, allowing a maliciously crafted NFC card to overwrite stack memory and redirect execution flow to attacker-controlled code. No authentication is required to trigger the flaw - proximity to the device and a crafted NFC card are the sole prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.
Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
Memory corruption in Xen allows guest VMs with Populated on Demand (PoD) enabled to cause denial of service by attempting to reclaim non-guest memory pages, corrupting hypervisor memory management state. No public exploit identified and SSVC indicates no current exploitation, but the flaw is automatable with partial technical impact.
Out-of-bounds read in libfsimage’s iso9660 directory walk allows local attackers with a crafted disk image to leak memory or crash the host when the image is mounted. The flaw arises from unvalidated record lengths read directly from attacker-controlled on-disk fields. No known active exploitation or public exploit code exists.
Information disclosure in gst-plugins-good's FLAC header parser within Matroska/WebM containers allows a local attacker to leak 4 bytes of heap memory by tricking a user into opening a malicious media file. The flaw has a low CVSS score (3
Kernel memory disclosure in Apple macOS allows a rogue application to read sensitive kernel data via an out-of-bounds read. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No public exploit identified and EPSS score is low (0.15%), indicating low exploitation risk in the wild.
A local denial-of-service vulnerability in macOS versions before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious app to cause unexpected system termination due to a memory handling flaw. Exploitation requires a low-privilege user to run a crafted application, and no active exploitation is known at this time.
A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.
Physical access to a locked Apple device running vulnerable iOS or macOS allows an attacker to view sensitive user information due to an out-of-bounds read. The flaw is fixed in iOS 26.6, iPadOS 26.6, and multiple macOS versions. No public exploit or active exploitation has been reported.
Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).
Denial of service in macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local malicious app to trigger memory corruption and crash the system. Exploitation requires user interaction to run the app; no active exploitation is known (not in CISA KEV) and EPSS indicates a very low probability (0.16%). Apple has released updates to address the logic issue.
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.
Information disclosure in macOS asset catalog processing allows local attackers to read process memory by enticing a user to open a malicious asset catalog. Affected versions prior to macOS Sequoia 15.7.8 and Sonoma 14.8.8 are vulnerable. No active exploitation or public exploit code exists; EPSS indicates low exploitation probability.
We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT
Out-of-bounds read in Apple macOS allows a local app to access sensitive user data. The vulnerability (CWE-787) has been patched in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app or file), and no public exploits are known to be in the wild.
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
A buffer overflow in the processing of 3D models on Apple iOS, iPadOS, and macOS leads to disclosure of process memory. Affected versions include iOS/iPadOS prior to 26.6 and macOS prior to Sequoia 15.7.8 and Tahoe 26.6. An attacker who can deliver a malicious 3D model to a victim could leak sensitive information; no active exploitation or public exploit has been reported, and the EPSS probability is low (0.18%).
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() bpa10x_setup() sends the vendor command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length: bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); hci_set_fw_info(hdev, "%s", skb->data + 1); A device that returns a one-byte response (status only) leaves skb->data + 1 past the end of the data, and the %s walk reads adjacent slab memory until it meets a NUL. The same happens when the payload is not NUL-terminated within skb->len. The out-of-bounds bytes end up in the kernel log and the firmware-info debugfs file. Print the revision string with a bounded "%.*s" limited to skb->len - 1 instead. This keeps the string readable for well-behaved devices while never reading past the received data, and does not fail setup, so a device returning a short or unterminated response keeps working.
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages. BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Kernel panic - not syncing: Fatal exception Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.
Denial of service in Zephyr's Synopsys DesignWare I2C driver (slave mode) enables an I2C master on the same physical bus to cause permanent failure of the write_requested() callback due to a missing START_DET interrupt enable. This halts all subsequent write transactions and desynchronizes higher-layer framing until device reset. No public exploit identified; patch available from vendor.
Out-of-bounds heap write in Erlang OTP's binary_to_term/1 function causes virtual machine crash via a maliciously crafted Erlang external term format (ETF) binary. The vulnerability, triggered by a signed/unsigned conversion error in LARGE_TUPLE_EXT decoding, affects OTP 25.0 through 27.3.4.14, 28.5.0.3, and 29.0.3. No authentication is required, and exploitation leads to denial of service; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in HDF5 through 2.1.1 enables attackers to crash applications and potentially corrupt data by providing a crafted HDF5 file. The flaw lies in the shared‑message list‑index deserializer (SOHM), allowing out‑of‑bounds heap reads and writes when a num_messages field exceeds the declared list_max. No active exploitation has been reported, but the issue is publicly documented and a proof‑of‑concept may exist in the linked issue.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Local attackers with low privileges can trigger an out-of-bounds read in whisper.cpp 1.8.4-58 by supplying a very short audio sample to the log_mel_spectrogram function. This heap read overflow may leak sensitive information but does not allow code execution or system compromise. No public exploit or active exploitation has been reported.
Denial-of-service in the Mercusys MB115-4G router's web interface allows unauthenticated attackers to crash the administration service by sending a crafted request to the /cgi/login endpoint. A stack buffer overflow in the http_gdpr_decrypt function corrupts memory and halts the httpd process, leaving the device operational but unmanageable through the web UI. A vendor patch is available; no public exploit or active exploitation has been identified.
Integer overflow in the print_string_ptr() function of the cJSON library on 32-bit platforms causes a heap buffer overflow when processing crafted JSON strings with approximately 858,993,460 control characters. Applications using cJSON_PrintBuffered() with a pre-allocated buffer are vulnerable, potentially leading to remote code execution, information disclosure, or denial of service. No public exploit or active exploitation has been identified at the time of analysis.
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit. It can be called from tcp_v[46]_timewait_ack() with twsk. Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access. $ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; /* 440 192 */ Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg->access_width changes depending on the reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses access_width to indicate the PCC region, which can result in a UBSAN if the value is greater than 4. For example: UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 shift exponent 32 is too large for 32-bit type 'int' CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) Hardware name: To be filled by O.E.M. Call trace: ...(trimming) ubsan_epilogue+0x10/0x48 __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 cpc_write+0x4d0/0x670 cppc_set_perf+0x18c/0x490 cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq] ... (trimming) Lets fix this by validating the region type, as well as whether access_width has a value. Then since we are returning bit_width directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting the size.
In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget: if (samples && count > samples) count = samples; which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]: bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address. Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching.
In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpu_mask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty the architecture initiates offline of the domain that includes calling on resctrl fs to offline the domain. If it is a monitoring domain in which LLC occupancy is tracked resctrl fs forces the limbo handler to clear all busy RMID state associated with the domain. The limbo handler always reads the current event value associated with a busy RMID irrespective of it being checked as part of regular "is it still busy" check or whether it will be forced released anyway. When reading an RMID on a system with SNC enabled the "logical RMID" is converted to the "physical RMID" and this conversion requires the NUMA node ID of the resctrl monitoring domain that is in turn determined by querying the NUMA node ID of any CPU belonging to the monitoring domain. When the monitoring domain is going offline its cpu_mask is empty causing the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as argument resulting in an out-of-bounds access. Refactor the limbo handler to skip reading the RMID when the RMID will just be forced to no longer be dirty in the domain anyway. Add a safety check to the architecture's RMID reader to protect against this scenario.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Atomic memory reserve exhaustion in the Linux kernel's iommufd subsystem allows a local low-privileged user to trigger kernel-side memory pressure by allocating virtual event queues whose depth is fully user-controlled, potentially destabilizing the system through GFP_ATOMIC reserve depletion. The root cause is memory allocation for veventq entries occurring inside a spinlock, drawing from atomic reserves never intended for user-directed exhaustion. No active exploitation is confirmed and EPSS sits at 0.21% (11th percentile); upstream fix commits are available across the 6.18.x, 7.1.x, and 7.2-rc1 stable series.
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.
Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Signed integer overflow in libarchive's ZIP writer (`archive_write_zip_header` in `archive_write_set_format_zip.c`) produces undefined behavior when ZIP encryption is enabled and a file entry size approaches INT64_MAX, causing the encryption overhead addition to wrap the int64_t type. The resulting undefined behavior may cause incorrect Zip64 extension logic - producing malformed archive structure - or, in worst-case scenarios, memory corruption that could affect availability of the consuming process. No public exploit or active exploitation has been identified; the CVSS score of 2.9 and high attack complexity reflect extreme trigger conditions that are practically unreachable in normal deployments.
Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to the shared backing file to redirect memory reads to arbitrary locations. The module's attach-time header validator (rb_validate_header) checks structural metadata but skips bucket content validation, so rb_contains_locked blindly trusts file-stored container offsets and cardinalities. On the next membership query, the process dereferences a fully attacker-controlled pointer and iterates over an attacker-controlled count, exposing adjacent heap or stack memory and potentially crashing the querying process. No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low real-world exploitation activity.
Out-of-bounds read in Eclipse OMR's arraycmp SIMD JIT implementation for IBM Z (s390x) and IBM POWER (P10) architectures - versions up to 0.11 - allows a low-privileged network-reachable attacker to trigger an application crash when a zero-length array comparison is JIT-compiled and executed. The flaw exists exclusively in the SIMD code-generation paths for these two architectures and has no impact on x86 or ARM deployments. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis; exploitation is further constrained by high attack complexity and the requirement for user interaction.
Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.
Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint. The flaw is in the `rpcbdump()` short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.
Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.
Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.
Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.
Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'
Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.
Out-of-bounds write in MediaTek's Trusted Firmware-A (TFA) component allows a local attacker already holding System-level privilege to crash the device, causing a denial of service. Affected hardware includes MediaTek Dimensity and Helio chipsets MT6986D, MT6986, and MT6982VB. No public exploit code has been identified and CISA KEV does not list this vulnerability, consistent with its low EPSS score of 0.14% and SSVC exploitation status of none.
Out-of-bounds write in the MediaTek Download Agent (DA) firmware component across eight chipset families allows an attacker with physical device access to trigger a local denial of service by sending a crafted payload while the device is in DA mode. Affected chipsets span mobile SoCs (MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) and modem/automotive chipsets (MT2735, MT2737), broadening the potential device footprint across Android smartphones and connected vehicle platforms. No public exploit code exists, EPSS sits at the 6th percentile (0.16%), SSVC confirms no known exploitation, and the physical access prerequisite fundamentally constrains real-world risk.
Local privilege escalation in MediaTek's apusys AI Processing Unit subsystem on MT8196 and MT8366 chipsets allows an attacker already holding System-level privileges to further escalate by exploiting a confused deputy flaw - likely realized through an out-of-bounds write (CWE-787) - achieving high confidentiality and integrity impact on the vulnerable system. Disclosed by MediaTek in their August 2026 Product Security Bulletin, a vendor patch is available under Patch ID AUTO00833804. No public exploit has been identified at time of analysis, and an EPSS of 0.14% at the 4th percentile reflects negligible probability of widespread exploitation.
Secure boot heap buffer overflow in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990 enables local privilege escalation by an attacker with physical device access. The vulnerability exists at the pre-OS firmware layer, where a write beyond allocated heap boundaries can corrupt boot verification logic and permit execution of unsigned or attacker-controlled code. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.16% (6th percentile) is consistent with the hard physical access prerequisite sharply limiting opportunistic exploitation.
Out-of-bounds write in the MediaTek HEVC video decoder enables further privilege escalation on devices running MT6761, MT8766, and MT8768 chipsets. The flaw, rooted in an integer overflow during HEVC bitstream processing, can be triggered without user interaction but only by an actor who already holds System-level privilege on the device. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment - though SSVC rates Technical Impact as total, reflecting the severity of what a successful second-stage exploit could achieve.
Stack-based buffer overflow in OreSat Firmware v1.0 allows an attacker with physical access to the UART3 serial interface to crash the firmware by sending a crafted `edl fw_flash` command with an oversized filename argument. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms impact is strictly limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code exists and no active exploitation has been identified; an EPSS score of 0.14% at the 4th percentile corroborates negligible automated exploitation probability.
Out-of-bounds heap read in FreeRDP's UVC H.264 extension-unit parser affects all versions prior to 3.29.0, allowing an attacker with physical USB access to trigger denial of service during camera stream setup. The parser fails to validate descriptor length before accessing the GUID field, enabling a read beyond allocated heap bounds when a malicious USB video camera is connected. No public exploit has been identified, KEV listing is absent, and the CVSS 4.0 score of 2.4 accurately reflects the constrained physical-access attack surface.
Out-of-bounds read in FreeRDP 3.28.0 and earlier allows a malicious or compromised RDP server to leak client-side memory contents or crash the FreeRDP process by sending a crafted truncated planar-encoded bitmap or surface update. The flaw lives in the RDP6 planar RLE decoder (libfreerdp/codec/planar.c), where attacker-declared raw byte counts of 0-15 bytes following a bounds-checked control byte are consumed without verifying remaining buffer space. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; FreeRDP 3.29.0 contains the confirmed vendor patch.
Out-of-bounds read in Zephyr RTOS DHCPv4 client (versions 1.7.0 through 4.4.x) allows an adjacent-network attacker to crash the DHCP client or leak adjacent pointer contents by sending a crafted DHCP reply with a message-type value greater than 8. The defect is a classic sizeof-vs-ARRAY_SIZE confusion: the bounds guard compares a raw msg_type byte against the byte-size of a pointer array (32 or 64, depending on architecture) rather than its element count of 8, so values 9-31/63 bypass the check and cause a wild-pointer dereference inside a debug log call. Exploitation is gated on a non-default build configuration (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), substantially reducing the real-world attack surface. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Buffer overflow in NTPsec's Zyfer refclock driver crashes the ntpd daemon on affected systems running versions prior to 1.2.5. A local, low-privileged attacker with high attack complexity can trigger the CWE-120 classic buffer overflow, resulting in a denial-of-service impact limited to availability - no confidentiality or integrity exposure exists. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5.
Out-of-bounds read in mz-automation/lib60870 allows unauthenticated remote attackers to leak one byte of heap memory and potentially crash the parsing process by sending a crafted IEC 60870-5-104 I-frame. The vulnerability triggers when a declared ASDU object count exceeds the actual data present in the message buffer, causing `InformationObject_ParseObjectAddress` to read one byte beyond the allocated heap region. Disclosed via CISA ICS Advisory ICSA-26-211-11 with no public exploit identified at time of analysis.
Out-of-bounds heap read in mz-automation's lib60870 library exposes ICS/SCADA systems to unauthenticated remote exploitation via a crafted IEC 60870-5-104 I-frame. An attacker sending a C_TS_NA_1 ASDU with an inflated object count triggers `TestCommand_getFromBuffer` to read one byte past the end of a heap-allocated buffer, producing partial heap memory disclosure and potential availability disruption. CISA ICS-CERT has published advisory ICSA-26-211-11; no active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Denial-of-service in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an adjacent unauthenticated attacker to crash the MMS server process by sending a crafted BER-encoded confirmed request PDU containing an extended BER tag over an established MMS session. The missing bounds check in the buffer decoder causes a one-byte heap out-of-bounds read, terminating the MMS service and disrupting IEC 61850-based industrial control communications. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Out-of-bounds heap read in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an unauthenticated adjacent-network attacker to crash an MMS server by sending a crafted AARQ PDU with a zero or one-byte length value in the calling AP title field during connection establishment. The ACSE parser fails to bounds-check the attacker-controlled length, reading past the end of a heap buffer and causing availability loss - a significant concern in IEC 61850 substation automation environments where device availability underpins grid protection and monitoring. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; a vendor patch (version 1.6.2) is available per CISA ICS advisory ICSA-26-211-10.
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately 4 KB beyond a heap allocation and conditionally crash the analyzer by embedding a crafted User-Agent string into any web server access log that GoAccess subsequently processes. The defect resides in the parse_ios() function (src/opesys.c), where an attacker-controlled keyword-to-OS offset value is incorrectly passed as both the source pointer offset and the copy length to memmove(), violating the intended semantics and enabling the out-of-bounds read. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in version 1.11.
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Stack exhaustion in PHP's phar archive handler allows an attacker to crash the PHP process by supplying a crafted archive containing circular symbolic links, triggering unbounded recursion that depletes the native C stack. Affected versions span PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9 across all platforms. Exploitation requires a PHP process to actively parse the malicious archive (UI:A/AV:L); no public exploit has been identified and exploitation likelihood is rated unlikely (E:U in the provided CVSS 4.0 vector), making this a moderate-priority patch for most deployments - with heightened urgency for applications that process user-supplied phar archives.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Heap-based buffer overflow in Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by physically present, unauthenticated attackers via malformed USB packets. The device's USB packet handler copies attacker-controlled data into a fixed-length heap buffer without validating input length, allowing full control of device execution context. Reported by Zero Day Initiative (ZDI-CAN-29048 / ZDI-26-436); no public exploit code identified at time of analysis and not listed in CISA KEV.
Stack-based buffer overflow in the NFC card response handler of Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by a physically present attacker. The device's NFC interface fails to enforce bounds on a fixed-length stack buffer when processing card responses, allowing a maliciously crafted NFC card to overwrite stack memory and redirect execution flow to attacker-controlled code. No authentication is required to trigger the flaw - proximity to the device and a crafted NFC card are the sole prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.
Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
Memory corruption in Xen allows guest VMs with Populated on Demand (PoD) enabled to cause denial of service by attempting to reclaim non-guest memory pages, corrupting hypervisor memory management state. No public exploit identified and SSVC indicates no current exploitation, but the flaw is automatable with partial technical impact.
Out-of-bounds read in libfsimage’s iso9660 directory walk allows local attackers with a crafted disk image to leak memory or crash the host when the image is mounted. The flaw arises from unvalidated record lengths read directly from attacker-controlled on-disk fields. No known active exploitation or public exploit code exists.
Information disclosure in gst-plugins-good's FLAC header parser within Matroska/WebM containers allows a local attacker to leak 4 bytes of heap memory by tricking a user into opening a malicious media file. The flaw has a low CVSS score (3
Kernel memory disclosure in Apple macOS allows a rogue application to read sensitive kernel data via an out-of-bounds read. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No public exploit identified and EPSS score is low (0.15%), indicating low exploitation risk in the wild.
A local denial-of-service vulnerability in macOS versions before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious app to cause unexpected system termination due to a memory handling flaw. Exploitation requires a low-privilege user to run a crafted application, and no active exploitation is known at this time.
A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.
Physical access to a locked Apple device running vulnerable iOS or macOS allows an attacker to view sensitive user information due to an out-of-bounds read. The flaw is fixed in iOS 26.6, iPadOS 26.6, and multiple macOS versions. No public exploit or active exploitation has been reported.
Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).
Denial of service in macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local malicious app to trigger memory corruption and crash the system. Exploitation requires user interaction to run the app; no active exploitation is known (not in CISA KEV) and EPSS indicates a very low probability (0.16%). Apple has released updates to address the logic issue.
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.
Information disclosure in macOS asset catalog processing allows local attackers to read process memory by enticing a user to open a malicious asset catalog. Affected versions prior to macOS Sequoia 15.7.8 and Sonoma 14.8.8 are vulnerable. No active exploitation or public exploit code exists; EPSS indicates low exploitation probability.
We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT
Out-of-bounds read in Apple macOS allows a local app to access sensitive user data. The vulnerability (CWE-787) has been patched in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app or file), and no public exploits are known to be in the wild.
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
A buffer overflow in the processing of 3D models on Apple iOS, iPadOS, and macOS leads to disclosure of process memory. Affected versions include iOS/iPadOS prior to 26.6 and macOS prior to Sequoia 15.7.8 and Tahoe 26.6. An attacker who can deliver a malicious 3D model to a victim could leak sensitive information; no active exploitation or public exploit has been reported, and the EPSS probability is low (0.18%).
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() bpa10x_setup() sends the vendor command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length: bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); hci_set_fw_info(hdev, "%s", skb->data + 1); A device that returns a one-byte response (status only) leaves skb->data + 1 past the end of the data, and the %s walk reads adjacent slab memory until it meets a NUL. The same happens when the payload is not NUL-terminated within skb->len. The out-of-bounds bytes end up in the kernel log and the firmware-info debugfs file. Print the revision string with a bounded "%.*s" limited to skb->len - 1 instead. This keeps the string readable for well-behaved devices while never reading past the received data, and does not fail setup, so a device returning a short or unterminated response keeps working.
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages. BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Kernel panic - not syncing: Fatal exception Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.
Denial of service in Zephyr's Synopsys DesignWare I2C driver (slave mode) enables an I2C master on the same physical bus to cause permanent failure of the write_requested() callback due to a missing START_DET interrupt enable. This halts all subsequent write transactions and desynchronizes higher-layer framing until device reset. No public exploit identified; patch available from vendor.
Out-of-bounds heap write in Erlang OTP's binary_to_term/1 function causes virtual machine crash via a maliciously crafted Erlang external term format (ETF) binary. The vulnerability, triggered by a signed/unsigned conversion error in LARGE_TUPLE_EXT decoding, affects OTP 25.0 through 27.3.4.14, 28.5.0.3, and 29.0.3. No authentication is required, and exploitation leads to denial of service; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in HDF5 through 2.1.1 enables attackers to crash applications and potentially corrupt data by providing a crafted HDF5 file. The flaw lies in the shared‑message list‑index deserializer (SOHM), allowing out‑of‑bounds heap reads and writes when a num_messages field exceeds the declared list_max. No active exploitation has been reported, but the issue is publicly documented and a proof‑of‑concept may exist in the linked issue.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Local attackers with low privileges can trigger an out-of-bounds read in whisper.cpp 1.8.4-58 by supplying a very short audio sample to the log_mel_spectrogram function. This heap read overflow may leak sensitive information but does not allow code execution or system compromise. No public exploit or active exploitation has been reported.
Denial-of-service in the Mercusys MB115-4G router's web interface allows unauthenticated attackers to crash the administration service by sending a crafted request to the /cgi/login endpoint. A stack buffer overflow in the http_gdpr_decrypt function corrupts memory and halts the httpd process, leaving the device operational but unmanageable through the web UI. A vendor patch is available; no public exploit or active exploitation has been identified.
Integer overflow in the print_string_ptr() function of the cJSON library on 32-bit platforms causes a heap buffer overflow when processing crafted JSON strings with approximately 858,993,460 control characters. Applications using cJSON_PrintBuffered() with a pre-allocated buffer are vulnerable, potentially leading to remote code execution, information disclosure, or denial of service. No public exploit or active exploitation has been identified at the time of analysis.
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit. It can be called from tcp_v[46]_timewait_ack() with twsk. Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access. $ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; /* 440 192 */ Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg->access_width changes depending on the reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses access_width to indicate the PCC region, which can result in a UBSAN if the value is greater than 4. For example: UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 shift exponent 32 is too large for 32-bit type 'int' CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) Hardware name: To be filled by O.E.M. Call trace: ...(trimming) ubsan_epilogue+0x10/0x48 __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 cpc_write+0x4d0/0x670 cppc_set_perf+0x18c/0x490 cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq] ... (trimming) Lets fix this by validating the region type, as well as whether access_width has a value. Then since we are returning bit_width directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting the size.
In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget: if (samples && count > samples) count = samples; which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]: bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address. Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching.
In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpu_mask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty the architecture initiates offline of the domain that includes calling on resctrl fs to offline the domain. If it is a monitoring domain in which LLC occupancy is tracked resctrl fs forces the limbo handler to clear all busy RMID state associated with the domain. The limbo handler always reads the current event value associated with a busy RMID irrespective of it being checked as part of regular "is it still busy" check or whether it will be forced released anyway. When reading an RMID on a system with SNC enabled the "logical RMID" is converted to the "physical RMID" and this conversion requires the NUMA node ID of the resctrl monitoring domain that is in turn determined by querying the NUMA node ID of any CPU belonging to the monitoring domain. When the monitoring domain is going offline its cpu_mask is empty causing the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as argument resulting in an out-of-bounds access. Refactor the limbo handler to skip reading the RMID when the RMID will just be forced to no longer be dirty in the domain anyway. Add a safety check to the architecture's RMID reader to protect against this scenario.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Atomic memory reserve exhaustion in the Linux kernel's iommufd subsystem allows a local low-privileged user to trigger kernel-side memory pressure by allocating virtual event queues whose depth is fully user-controlled, potentially destabilizing the system through GFP_ATOMIC reserve depletion. The root cause is memory allocation for veventq entries occurring inside a spinlock, drawing from atomic reserves never intended for user-directed exhaustion. No active exploitation is confirmed and EPSS sits at 0.21% (11th percentile); upstream fix commits are available across the 6.18.x, 7.1.x, and 7.2-rc1 stable series.
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.
Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Signed integer overflow in libarchive's ZIP writer (`archive_write_zip_header` in `archive_write_set_format_zip.c`) produces undefined behavior when ZIP encryption is enabled and a file entry size approaches INT64_MAX, causing the encryption overhead addition to wrap the int64_t type. The resulting undefined behavior may cause incorrect Zip64 extension logic - producing malformed archive structure - or, in worst-case scenarios, memory corruption that could affect availability of the consuming process. No public exploit or active exploitation has been identified; the CVSS score of 2.9 and high attack complexity reflect extreme trigger conditions that are practically unreachable in normal deployments.
Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to the shared backing file to redirect memory reads to arbitrary locations. The module's attach-time header validator (rb_validate_header) checks structural metadata but skips bucket content validation, so rb_contains_locked blindly trusts file-stored container offsets and cardinalities. On the next membership query, the process dereferences a fully attacker-controlled pointer and iterates over an attacker-controlled count, exposing adjacent heap or stack memory and potentially crashing the querying process. No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low real-world exploitation activity.
Out-of-bounds read in Eclipse OMR's arraycmp SIMD JIT implementation for IBM Z (s390x) and IBM POWER (P10) architectures - versions up to 0.11 - allows a low-privileged network-reachable attacker to trigger an application crash when a zero-length array comparison is JIT-compiled and executed. The flaw exists exclusively in the SIMD code-generation paths for these two architectures and has no impact on x86 or ARM deployments. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis; exploitation is further constrained by high attack complexity and the requirement for user interaction.
Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.
Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint. The flaw is in the `rpcbdump()` short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.
Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.