Buffer Overflow
Monthly
Heap-based buffer overflow in Libgcrypt before 1.12.2 allows local attackers to trigger denial of service and corrupt memory via crafted ECDH ciphertext passed to gcry_pk_decrypt, affecting cryptographic operations in dependent applications including GnuPG. No public exploit code or active exploitation has been identified at time of analysis; vendor has released patched versions 1.10.4, 1.11.3, and 1.12.2 to resolve the vulnerability.
Buffer over-read in rust-openssl's password callback APIs allows information disclosure when a user-supplied callback returns a value larger than the provided buffer. The vulnerability affects rust-openssl bindings to OpenSSL 1.x and 2.x; OpenSSL 3.x implementations are not vulnerable. An attacker who controls the password callback can read sensitive data from adjacent memory regions.
OpenVPN's TLS handshake race condition exposes confidential packet data from prior handshake sessions to authenticated remote attackers, affecting versions before 2.6.20 in the 2.6.x branch and before 2.7.2 in the 2.7.x branch. The CWE-125 out-of-bounds read flaw scores 6.1 under CVSS 4.0 with High confidentiality and availability impacts, though the AC:H (High Complexity) rating reflects that successful exploitation requires winning a narrow timing window, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; vendor-released patches for both stable branches were published April 22, 2026.
Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue backend server. An attacker controlling a backend DNS server can send a specially crafted UDP response with a query ID set off-by-one from the maximum configured value, triggering memory corruption that crashes the DNS forwarder. The CVSS score of 6.5 reflects network attack vector with high complexity and absence of confidentiality impact, though availability and integrity are affected.
dnsdist's Discovery of Designated Resolvers (DDR) upgrade mechanism allows a rogue backend to send a crafted SVCB response that causes a denial of service via availability impact when DDR is explicitly enabled through the autoUpgrade (Lua) or auto_upgrade (YAML) configuration options. The vulnerability requires adjacent network access and high complexity exploitation conditions, affecting only deployments that have manually enabled DDR functionality-a non-default configuration.
Out-of-bounds memory read in dnsdist allows remote attackers to trigger information disclosure or denial of service when custom Lua code invokes getDomainListByAddress() or getAddressListByDomain() functions on a crafted packet cache entry. The vulnerability requires network access but has high attack complexity, limiting real-world exploitation despite the remote attack vector.
Memory leak and out-of-bounds read in the asus_report_fixup() HID driver function allows local authenticated attackers with limited privileges to cause denial of service through memory exhaustion. The vulnerability affects the ASUS HID device driver across multiple Linux kernel versions, where kmemdup()-allocated buffers were not freed properly and an out-of-bounds read could access memory beyond the original descriptor size. A patch is available from Linux kernel maintainers switching to devm_kzalloc() for proper memory lifecycle management.
Linux kernel module loader fails to validate ELF section index bounds in simplify_symbols(), causing kernel panic when processing modules with out-of-bounds st_shndx values such as SHN_XINDEX (0xffff). Local privileged attackers can crash the system by loading malformed or legitimately-crafted modules that exploit this missing bounds check, resulting in denial of service. The vulnerability affects all stable kernel versions from 2.6.12 through current releases; patches are available across multiple stable branches (5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, 7.0+).
Integer overflow in Linux kernel RDMA/irdma depth calculation functions allows local authenticated users to trigger a denial of service via improper handling of U32_MAX values passed for SQ/RQ/SRQ size parameters. The vulnerability stems from depth calculations performed in 32-bit integers rather than 64-bit, enabling truncation that bypasses validation and returns success when allocation should fail, potentially causing system instability or resource exhaustion.
Integer overflow in constant tensor data size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause incorrect buffer sizing for large constant nodes, leading to buffer overflow conditions that may result in information disclosure or denial of service. The vulnerability requires local access and user interaction but can trigger high-severity memory corruption due to incorrect buffer allocation for tensors exceeding integer size limits.
Integer overflow in tensor copy size calculation within Samsung Open Source ONE enables out of bounds memory access during loop state propagation. Unauthenticated local attackers with user interaction can trigger the overflow to read sensitive data, modify memory, or cause denial of service on affected versions prior to 1.30.0. CVSS 6.6 indicates moderate severity with high availability impact.
Integer overflow in scratch buffer initialization within Samsung Open Source ONE allows local attackers with user interaction to cause denial of service and memory corruption affecting large intermediate tensor processing. Versions prior to 1.30.0 are vulnerable. The vulnerability stems from incorrect size calculation during memory allocation for scratch buffers, resulting in undersized allocations that corrupt adjacent memory regions when large tensors are processed.
Integer overflow in memory copy size calculation in Samsung Open Source ONE prior to commit 1.30.0 allows local attackers with user privileges to trigger invalid memory operations by supplying tensors with large shapes, potentially causing information disclosure, data corruption, or denial of service. The vulnerability requires user interaction (UI:R) and operates with low attack complexity on local systems. No public exploit code or active exploitation has been identified.
Integer overflow in Samsung Open Source ONE's output tensor copy size calculation allows local attackers with user interaction to cause memory corruption and potential code execution through oversized tensor processing. The vulnerability affects versions prior to 1.30.0 and stems from improper integer arithmetic when computing copy lengths for tensor data, enabling an attacker to trigger buffer overflows by crafting malicious tensor inputs that bypass size validation.
Integer overflow in tensor buffer size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user-level privileges to cause out-of-bounds memory access, leading to information disclosure and denial of service. The vulnerability requires user interaction to process specially crafted large tensor data. CVSS 6.6 indicates moderate severity with local attack vector and high availability impact.
Integer overflow in tensor allocation size calculation within Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause denial of service or memory corruption. The vulnerability arises when processing large tensors, where insufficient memory allocation due to integer wraparound can lead to heap corruption. While CVSS indicates moderate severity (5.3), the high attack complexity and user interaction requirements limit practical exploitation.
BACnet Stack prior to version 1.4.3 exhibits undefined behavior in the decode_signed32() function when processing signed-integer property values containing bytes with the high bit set, causing denial of service through integer overflow. Network-remote attackers can trigger this vulnerability by sending specially crafted BACnet packets with high-bit-set byte sequences, resulting in application instability or crash on embedded systems running vulnerable versions. The vulnerability is confirmed fixed in version 1.4.3.
Storable versions before 3.05 for Perl has a stack overflow. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow in Firefox's Audio/Video Playback component allows remote unauthenticated attackers to cause integrity violations through specially crafted multimedia content. The vulnerability stems from incorrect boundary condition handling in numeric calculations, potentially enabling attackers to modify playback state or corrupt audio/video streams without user interaction. Firefox 150 and later contain the fix.
Incorrect boundary conditions in Firefox's WebRTC component allow remote attackers to read limited memory contents without authentication. Firefox versions prior to 150 are affected by this low-confidentiality vulnerability, which CVSS rates at 5.3 due to network exploitability without user interaction, though CISA's SSVC framework indicates no current exploitation activity and limited technical impact.
Confidentiality compromise in Firefox NSS Libraries allows remote unauthenticated attackers to leak sensitive information over the network without user interaction. The vulnerability affects Firefox 150 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier, and has been patched in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. No public exploit code or active exploitation has been identified at the time of analysis.
Incorrect boundary conditions in Firefox's DOM Device Interfaces component allow remote attackers to cause limited data corruption and browser instability without authentication or user interaction, per CVSS vector AV:N/AC:L/PR:N/UI:N. Vendor-released patches are confirmed in Firefox 150 and Firefox ESR 140.10, with downstream Red Hat and SUSE advisories also issued. No public exploit has been identified at time of analysis, and EPSS at 0.04% (13th percentile) alongside SSVC exploitation status of 'none' indicate low real-world exploitation likelihood despite the moderate CVSS score.
Signed integer overflow in OpenEXR 3.4.0-3.4.9 HTJ2K decompression allows remote attackers to cause denial of service via crafted EXR files with excessive FLOAT channels. The `ht_undo_impl()` function accumulates a bytes-per-line value in a 32-bit signed integer without overflow protection; on memory-permissive systems, the wrapped negative value enables heap out-of-bounds writes. OpenEXR 3.4.10 contains the fix. This is a distinct overflow from CVE-2026-34545 in the same function and mirrors the pattern of CVE-2026-34588.
Out-of-bounds read in wolfSSHd on Windows allows authenticated users to leak adjacent stack memory via malformed terminal resize requests, exposing sensitive data through pseudo-console output. Affects wolfSSH versions prior to 1.5.0. CVSS score of 2.3 reflects low severity due to authentication requirement and limited confidentiality impact; vendor patch available.
Stack-based buffer overflow in Dell PowerProtect Data Domain versions 7.7.1.0-8.6, LTS2025 8.3.1.0-8.3.1.20, and LTS2024 7.13.1.0-7.13.1.60 allows high-privileged local attackers to execute arbitrary commands as root. The vulnerability requires local access and elevated privileges, limiting exposure to insider threats or compromised administrative accounts rather than remote attackers. No public exploit has been identified at time of analysis.
Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers to trigger a temporary denial-of-service condition via crafted network packets to the sx_smpd service. CVSS score is 5.3 (moderate) with confirmed active reporting by JPCERT, though no public exploit code or CISA KEV listing is evident from available data. Attack requires only network access and no authentication or user interaction.
Stack-use-after-return memory corruption in Arduino_Core_STM32 (stm32duino) allows local low-privileged actors to trigger undefined behavior via dangling pointer dereference in interrupt service routines on devices running firmware built with versions prior to 1.7.0. The pwm_start() function stores a stack-allocated TIM_HandleTypeDef pointer in a global HAL timer registry; once the function returns and the stack frame is reclaimed, any timer ISR that fires will dereference a now-invalid pointer, corrupting memory. A researcher disclosure repository (CVE-2026-26399-Disclosure) is publicly referenced, suggesting exploit details exist, though EPSS at 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm no broad active exploitation at time of analysis.
Integer overflow in Little CMS (lcms2) version 2.18 and earlier allows local attackers to trigger a buffer overflow via CubeSize calculation in cmslut.c, where the overflow check occurs after rather than before multiplication. This can result in memory corruption leading to information disclosure or denial of service with low complexity requirements. No active exploitation in CISA KEV confirmed at time of analysis, but proof-of-concept technical details are publicly available.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical USB access to crash the library via malformed PTP protocol data from untrusted camera devices, affecting applications using libgphoto2 for camera enumeration and control on desktop systems.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a USB-connected camera to trigger information disclosure or denial of service via malformed PTP protocol data during Samsung Galaxy device enumeration. The vulnerability exists in `ptp_unpack_OI()` which validates buffer boundaries at 48 bytes but subsequently reads up to 56 bytes, exceeding the boundary by 9 bytes. A fix is available in commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a connected camera to read sensitive memory and potentially cause denial of service via a specially crafted Sony camera device. The vulnerability exists in the Sony-specific PTP packet unpacking function which omits bounds validation present in the standard variant, enabling attackers with direct camera access to trigger information disclosure and minor availability impact.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows physical attackers to disclose sensitive memory and cause denial of service via a malicious PTP (Picture Transfer Protocol) device. The vulnerability exists in the Sony-specific DPD unpacking function, which fails to validate buffer boundaries before reading an enumeration count, enabling attackers with direct device access to craft responses that trigger the out-of-bounds read. Patch is available via upstream commit 3b9f9696be76ae51dca983d9dd8ce586a2561845.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 in the PTP protocol parser allows information disclosure and potential denial of service when processing specially crafted camera responses. The vulnerability exists in ptp_unpack_DPV() where UINT128 and INT128 cases advance the buffer offset by 16 bytes without verifying sufficient buffer remains available, potentially exposing adjacent memory. Exploitation requires physical access to connect a malicious camera device (AV:P), but no special authentication or user interaction is needed once connected. No public exploit code identified at time of analysis.
Missing null terminator in libgphoto2's ptp_unpack_Canon_FE() function allows out-of-bounds memory reads when processing Canon camera filenames. Versions up to 2.5.33 are vulnerable when a 13-byte filename without null termination is supplied, causing subsequent string operations to read beyond buffer boundaries. The vulnerability requires physical camera access and results in information disclosure or denial of service, not remote code execution.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a connected camera to read sensitive information from process memory or cause denial of service via malformed EOS event data. Two functions in ptp-pack.c lack length validation, enabling unbounded buffer reads when processing camera events. The vulnerability requires physical device access and is not remotely exploitable, with no public exploit code identified at time of analysis.
Heap-based buffer overflow in xrdp 0.10.5 and earlier allows unauthenticated remote attackers to cause denial of service or memory corruption when the domain_user_separator configuration directive is explicitly enabled in xrdp.ini. An attacker sends a crafted RDP logon request with an excessively long username and domain name combination that overflows an internal buffer, corrupting adjacent memory regions. The vulnerability requires non-default configuration (domain_user_separator must be uncommented) and affects only systems with this setting enabled. Vendor-released patch: version 0.10.6.
Heap-based buffer overflow in libvips up to version 8.18.2 via the deprecated im_minpos_vec function in libvips/deprecated/vips7compat.c allows authenticated local attackers to trigger memory corruption through manipulation of the argument n, with publicly available exploit code confirmed and vendor commitment to remove the deprecated code in libvips 8.19.
Out-of-bounds reads in openCryptoki's BER/DER decoding layer expose Linux and AIX systems to cryptographic service disruption and limited memory disclosure across all token backends. All five primitive decoders in the shared asn1.c library lack buffer-length parameters, accepting attacker-controlled BER length fields without validating them against actual buffer boundaries - a condition reachable via PKCS#11 API operations (C_CreateObject, C_UnwrapKey), token file loading from disk, or remote backend channels (ICSF). Proof-of-concept code exists per SSVC classification, though EPSS sits at 0.01% and no confirmed active exploitation (CISA KEV) has been recorded.
Buffer overflow in the Ruby zlib gem's Zlib::GzipReader allows remote or local attackers supplying crafted gzip data to corrupt process memory via the zstream_buffer_ungets function. Affected versions span all 3.0.x releases through 3.0.0, the 3.1.0-3.1.1 range, and 3.2.0-3.2.1, collectively covering a wide install base across Ruby 3.2 and 3.3 runtime environments. The vulnerability carries an EPSS of 0.04% (13th percentile) and is not listed in CISA KEV, indicating low current exploitation probability despite the memory-corruption class of the flaw.
ONLYOFFICE DocumentServer before 9.3.0 contains an untrusted pointer dereference vulnerability in XLS file processing that enables authenticated remote attackers to leak sensitive memory and bypass ASLR protections. The vulnerability affects XLS conversion workflows through multiple vectors including pictFmla.cbBufInCtlStm manipulation, allowing information disclosure without requiring user interaction. CVSS 5.0 reflects moderate risk given network accessibility and the authentication barrier, though the scope change to CVSS:C indicates potential cross-boundary impact.
Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.
A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).
Information disclosure in Google Chrome prior to version 147.0.7727.101 allows a remote attacker to obtain sensitive information from process memory by enticing a user to open a crafted file. The vulnerability, rated Medium severity by Chrome, resides in the Skia graphics library and is not currently listed in CISA KEV, with a low EPSS exploitation probability (0.03%). A patch is available from Google.
Information disclosure in Google Chrome prior to 147.0.7727.101 allows a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. No public exploit or active exploitation has been identified at this time, and EPSS indicates very low exploitation probability (0.01%).
Buffer overflow in GIMP's file-seattle-filmworks plugin allows denial of service when a user opens a specially crafted Seattle Filmworks file. A remote attacker can deliver the malicious file via email or download, triggering a crash of the plugin and potentially impacting GIMP's stability. No active exploitation or public exploit code has been identified.
Denial of service in GIMP's PVR image loader on Red Hat Enterprise Linux 6 through 9 allows an attacker to crash the application by tricking a user into opening a specially crafted PVR file. The flaw arises from a stack-based buffer overflow and out-of-bounds read, causing the application to terminate unexpectedly. It is not known to be actively exploited; proof-of-concept code has not been publicly identified.
GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.
Denial of service in GIMP allows local attackers to crash the application by tricking a user into opening a malicious TIM image file. The vulnerability resides in the TIM image loader's 4BPP decoding path, where an unconditional stack buffer overflow occurs when processing a specially crafted file, with no impact on confidentiality or integrity. No active exploitation or public exploit is known, and a vendor patch is available.
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Local denial of service in SSSD's PAM passkey responder allows a low-privileged attacker to crash the daemon by sending crafted passkey authentication data, disrupting authentication services on affected Red Hat Enterprise Linux and OpenShift systems. The vulnerability is not known to be actively exploited, and its EPSS score is negligible (0.01%).
Heap-based buffer overflow in Adobe FrameMaker 2022.8 and earlier allows local attackers to disclose sensitive information from process memory without user privileges, requiring only that a victim open a malicious document. CVSS 5.5 reflects confidentiality impact with low attack complexity, though no active exploitation or public proof-of-concept has been confirmed at analysis time.
Out-of-bounds write in Adobe DNG SDK 1.7.1 2502 and earlier causes application denial-of-service through memory corruption when processing malicious DNG files. The vulnerability requires user interaction (opening a crafted file) and affects local attackers on systems where DNG SDK is deployed; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in Windows GDI allows local unauthenticated attackers to disclose sensitive information with user interaction. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, all Windows 11 versions from 22H3 through 26H1, and Windows Server 2012 through 2025. No public exploit code or active exploitation has been confirmed; a vendor patch is available.
Buffer over-read in Windows Kernel Memory allows authenticated local attackers to disclose sensitive kernel information with high confidence. CVE-2026-26169 affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016 through 2025. The vulnerability requires local access and low-level user privileges but does not enable privilege escalation or code execution. Microsoft has released vendor patches addressing the issue across all affected versions.
Out-of-bounds read in Microsoft Office Word enables local information disclosure when a user opens a malicious document, affecting Microsoft 365 Apps for Enterprise and Office LTSC for Mac 2021/2024. The vulnerability requires user interaction (document opening) but does not require elevated privileges, with a CVSS score of 6.1 reflecting moderate severity. Microsoft has released patches addressing this issue across affected product lines.
Heap-based buffer overflow in Windows USB Print Driver allows local privilege escalation via physical device access. Affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, with patch available from Microsoft. Attack requires physical USB access and no user interaction; no public exploit identified at time of analysis.
Out-of-bounds read in Windows GDI (Graphics Device Interface) allows local attackers to disclose sensitive information without authentication. The vulnerability affects Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server 2022/2025, requiring user interaction to trigger. Microsoft has released patches for all affected versions, with specific build numbers provided for remediation.
Microsoft Local Security Authority Subsystem Service (LSASS) information disclosure vulnerability allows authenticated network attackers to read sensitive memory contents via a bounds check bypass in the LSASS process. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. No public exploit code or active exploitation has been reported; vendor-released patches are available across all affected versions.
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows local attackers to cause application denial-of-service by crafting malicious files that trigger memory corruption when opened. This vulnerability requires user interaction to exploit and does not enable code execution or data compromise, making it primarily a disruption vector rather than a critical attack surface despite its moderate CVSS score of 5.5.
Heap-based buffer overflow in Adobe InDesign Desktop versions 21.2 and earlier allows local attackers to disclose sensitive information from memory without authentication, requiring only user interaction to open a malicious file. The vulnerability has a CVSS score of 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been confirmed at time of analysis.
Memory corruption in Python's asyncio introspection and profiling.sampling modules (3.14-3.15) allows a local attacker with high privileges to read and write arbitrary memory in a connected privileged Python process via remote debugging. Exploitation requires persistent, repeated connections and high tolerance for crashes due to ASLR; no public exploit code has been identified. SSVC framework rates technical impact as total, but exploitation remains none-indicating low real-world priority despite severe capability impact.
Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process termination when processing malformed JSON in non-NUL-terminated buffers. All jq releases before commit 2f09060afab23fe9390cce7cb860b10416e1bf5f are affected per CPE cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*. SSVC marks the flaw as automatable with a POC noted, though EPSS sits at only 0.04% and CISA KEV has not listed it, indicating no confirmed widespread exploitation at time of analysis.
Out-of-bounds read in jq release builds allows an attacker who controls filter input to crash the processor or probe process memory by passing a non-string argument to the _strindices builtin. Release builds compiled with -DNDEBUG strip the assert() type guards in jv_string_indexes(), enabling a type confusion that escalates from trivial denial-of-service to a controlled pointer dereference and limited memory read primitive via IEEE-754 bit-pattern manipulation. Publicly available exploit code exists per SSVC; EPSS remains at 0.01% (2nd percentile), indicating no widespread exploitation, and the attack is not in CISA KEV.
Heap out-of-bounds write in ImageMagick's JP2 (JPEG 2000) encoder affects all versions of the 7.x branch below 7.1.2-19 and the 6.x branch below 6.9.13-44, as well as the Magick.NET .NET bindings below 14.12.0. When a user specifies an invalid (zero or negative) subsampling index during JP2 encoding, the subsampling_dx and subsampling_dy parameters are cast to int without clamping, enabling a write beyond the allocated heap buffer. The attack vector is local with required user interaction (AV:L/UI:R), EPSS is 0.01% (2nd percentile), SSVC classifies exploitation as none and non-automatable, and no public exploit or KEV listing exists - placing this firmly in the low-urgency remediation tier for most environments.
Heap write overflow in ImageMagick's JXL encoder crashes the process when 16-bit float encoding is requested, affecting all versions below 7.1.2-19 and Magick.NET NuGet packages below 14.12.0. The overflow writes out-of-bounds to heap memory, causing a denial-of-service condition with no confidentiality or integrity impact. No public exploit has been identified at time of analysis and EPSS sits at 0.01% (2nd percentile), consistent with SSVC assessment of zero active exploitation.
Heap-based buffer overflow in ImageMagick's YAML and JSON encoders allows a local attacker to crash the process by supplying a crafted image file converted to YAML or JSON output format. All ImageMagick versions below 7.1.2-19 are affected, including multiple Magick.NET NuGet packages below 14.12.0. A public proof-of-concept exploit exists, but EPSS remains at 0.01% (2nd percentile) and SSVC classifies exploitation as 'none', indicating no observed active exploitation at time of analysis.
Out-of-bounds read in ImageMagick's -sample resizing operation allows local attackers to crash the process when the sample:offset define is set to a specific value, causing denial of service in versions below 7.1.2-19 and 6.9.13-44. The flaw originates in SampleImage() within MagickCore/resize.c, where a precomputed offset array was used to index into a pixel scanline buffer without adequate bounds enforcement. No public exploit exists and CISA KEV does not list active exploitation; EPSS at 0.01% (2nd percentile) and SSVC exploitation:none confirm this is a low-urgency issue despite its presence in a widely-distributed tool.
Heap-based buffer overflow in ImageMagick's XML parser writes a single out-of-bounds null byte when processing XML content with a zero-length buffer, affecting all ImageMagick releases prior to 7.1.2-19 and 6.9.13-44, and all Magick.NET NuGet packages prior to 14.12.0. The flaw in MagickCore/xml-tree.c allows an unauthenticated remote attacker to crash the ImageMagick process by supplying a crafted XML file, resulting in a denial-of-service condition with no confidentiality or integrity impact confirmed by NVD. No public exploit code is identified at time of analysis, and the EPSS score of 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate very low near-term exploitation probability.
Integer overflow in ImageMagick's despeckle operation corrupts the heap on 32-bit builds, enabling an out-of-bounds write that crashes the process. Affected are ImageMagick before 7.1.2-19 and 6.9.13-44, and all Magick.NET NuGet packages before 14.12.0. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.01% (2nd percentile) and SSVC exploitation status of none confirm this as a low-urgency, patch-when-convenient finding for most organizations.
Integer overflow in OpenJPEG's opj_pi_initialise_encode function (versions 2.5.0-2.5.4) allows authenticated local attackers to trigger availability impact via crafted input to the pi.c library module. The vulnerability has a publicly available proof-of-concept and carries an EPSS score of 0.01% (2nd percentile), reflecting minimal real-world exploitation likelihood despite the presence of exploit code. Patch commit 839936aa33eb8899bbbd80fda02796bb65068951 is available from the vendor.
Out-of-bounds write in Huawei HarmonyOS WEB module allows local attackers without privileges to cause integrity and availability impact through a classic buffer overflow condition. CVSS 5.1 (moderate) reflects local-only attack vector and limited scope, though the vulnerability affects a core web rendering component. No active exploitation or public proof-of-concept confirmed at time of analysis.
Integer overflow in Samsung Open Source Escargot causes undefined behavior and potential denial of service on local systems. The vulnerability affects the Escargot JavaScript engine (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and related versions) and requires local access with low complexity to trigger. With CVSS 5.1 and EPSS not specified, the risk is moderate; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine exposes sensitive memory content to remote attackers through user interaction. The vulnerability affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and allows information disclosure with partial availability impact. CVSS 5.9 (medium) reflects the requirement for user interaction and high complexity attack prerequisites, though the memory exposure potential warrants monitoring for patches.
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine allows local attackers to leak sensitive memory contents and cause denial of service. Affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and potentially other versions; the vulnerability requires local access and specific conditions to trigger but can expose confidential data and crash the application without authentication. No public exploit identified at time of analysis.
Local privilege escalation in HarmonyOS application read module allows unauthenticated local attackers to cause memory corruption through a boundary-unlimited buffer overflow, potentially achieving code execution or system crash with high availability impact. CVSS 6.8 reflects local attack vector with integrity and availability consequences. Huawei has released security bulletins addressing this CWE-119 vulnerability affecting HarmonyOS devices.
Out-of-bounds write in HarmonyOS file system allows local privileged attackers to corrupt memory with high impact on confidentiality, integrity, and availability. The vulnerability affects HarmonyOS across versions and requires high-level local system privileges to exploit, making it a critical concern for multi-user systems and containerized deployments where privilege escalation vectors exist.
Out-of-bounds write vulnerability in Huawei HarmonyOS and EMUI kernel modules allows local privileged attackers to achieve arbitrary memory corruption, potentially compromising system confidentiality and availability. The vulnerability requires high privilege context and nontrivial user interaction to trigger, limiting real-world exploitation scope despite moderate CVSS scoring.
Denial of service in Parani M10 Motorcycle Intercom v2.1.3 via crafted Bluetooth RFCOMM frames allows unauthenticated attackers within wireless range to crash the device. The vulnerability exploits a buffer overflow in the RFCOMM service handler, causing high availability impact. A proof-of-concept exists but active exploitation has not been confirmed; EPSS score of 0.02% suggests limited real-world exploitation pressure despite the accessible attack vector.
Stack overflow in tinyobjloader's experimental MTL file parser (tinyobj_loader_opt.h) allows local attackers to trigger denial of service by supplying a malformed .mtl file. The vulnerability affects the library's material file parsing logic and crashes the application via stack memory corruption, though with EPSS score of 0.01% and no confirmed active exploitation, real-world risk is minimal despite the moderate CVSS 6.2 rating.
BlueAuditor 1.7.2.0 contains a buffer overflow vulnerability in the registration key field that allows local attackers to crash the application by submitting an oversized key value. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in Libgcrypt before 1.12.2 allows local attackers to trigger denial of service and corrupt memory via crafted ECDH ciphertext passed to gcry_pk_decrypt, affecting cryptographic operations in dependent applications including GnuPG. No public exploit code or active exploitation has been identified at time of analysis; vendor has released patched versions 1.10.4, 1.11.3, and 1.12.2 to resolve the vulnerability.
Buffer over-read in rust-openssl's password callback APIs allows information disclosure when a user-supplied callback returns a value larger than the provided buffer. The vulnerability affects rust-openssl bindings to OpenSSL 1.x and 2.x; OpenSSL 3.x implementations are not vulnerable. An attacker who controls the password callback can read sensitive data from adjacent memory regions.
OpenVPN's TLS handshake race condition exposes confidential packet data from prior handshake sessions to authenticated remote attackers, affecting versions before 2.6.20 in the 2.6.x branch and before 2.7.2 in the 2.7.x branch. The CWE-125 out-of-bounds read flaw scores 6.1 under CVSS 4.0 with High confidentiality and availability impacts, though the AC:H (High Complexity) rating reflects that successful exploitation requires winning a narrow timing window, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; vendor-released patches for both stable branches were published April 22, 2026.
Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue backend server. An attacker controlling a backend DNS server can send a specially crafted UDP response with a query ID set off-by-one from the maximum configured value, triggering memory corruption that crashes the DNS forwarder. The CVSS score of 6.5 reflects network attack vector with high complexity and absence of confidentiality impact, though availability and integrity are affected.
dnsdist's Discovery of Designated Resolvers (DDR) upgrade mechanism allows a rogue backend to send a crafted SVCB response that causes a denial of service via availability impact when DDR is explicitly enabled through the autoUpgrade (Lua) or auto_upgrade (YAML) configuration options. The vulnerability requires adjacent network access and high complexity exploitation conditions, affecting only deployments that have manually enabled DDR functionality-a non-default configuration.
Out-of-bounds memory read in dnsdist allows remote attackers to trigger information disclosure or denial of service when custom Lua code invokes getDomainListByAddress() or getAddressListByDomain() functions on a crafted packet cache entry. The vulnerability requires network access but has high attack complexity, limiting real-world exploitation despite the remote attack vector.
Memory leak and out-of-bounds read in the asus_report_fixup() HID driver function allows local authenticated attackers with limited privileges to cause denial of service through memory exhaustion. The vulnerability affects the ASUS HID device driver across multiple Linux kernel versions, where kmemdup()-allocated buffers were not freed properly and an out-of-bounds read could access memory beyond the original descriptor size. A patch is available from Linux kernel maintainers switching to devm_kzalloc() for proper memory lifecycle management.
Linux kernel module loader fails to validate ELF section index bounds in simplify_symbols(), causing kernel panic when processing modules with out-of-bounds st_shndx values such as SHN_XINDEX (0xffff). Local privileged attackers can crash the system by loading malformed or legitimately-crafted modules that exploit this missing bounds check, resulting in denial of service. The vulnerability affects all stable kernel versions from 2.6.12 through current releases; patches are available across multiple stable branches (5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, 7.0+).
Integer overflow in Linux kernel RDMA/irdma depth calculation functions allows local authenticated users to trigger a denial of service via improper handling of U32_MAX values passed for SQ/RQ/SRQ size parameters. The vulnerability stems from depth calculations performed in 32-bit integers rather than 64-bit, enabling truncation that bypasses validation and returns success when allocation should fail, potentially causing system instability or resource exhaustion.
Integer overflow in constant tensor data size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause incorrect buffer sizing for large constant nodes, leading to buffer overflow conditions that may result in information disclosure or denial of service. The vulnerability requires local access and user interaction but can trigger high-severity memory corruption due to incorrect buffer allocation for tensors exceeding integer size limits.
Integer overflow in tensor copy size calculation within Samsung Open Source ONE enables out of bounds memory access during loop state propagation. Unauthenticated local attackers with user interaction can trigger the overflow to read sensitive data, modify memory, or cause denial of service on affected versions prior to 1.30.0. CVSS 6.6 indicates moderate severity with high availability impact.
Integer overflow in scratch buffer initialization within Samsung Open Source ONE allows local attackers with user interaction to cause denial of service and memory corruption affecting large intermediate tensor processing. Versions prior to 1.30.0 are vulnerable. The vulnerability stems from incorrect size calculation during memory allocation for scratch buffers, resulting in undersized allocations that corrupt adjacent memory regions when large tensors are processed.
Integer overflow in memory copy size calculation in Samsung Open Source ONE prior to commit 1.30.0 allows local attackers with user privileges to trigger invalid memory operations by supplying tensors with large shapes, potentially causing information disclosure, data corruption, or denial of service. The vulnerability requires user interaction (UI:R) and operates with low attack complexity on local systems. No public exploit code or active exploitation has been identified.
Integer overflow in Samsung Open Source ONE's output tensor copy size calculation allows local attackers with user interaction to cause memory corruption and potential code execution through oversized tensor processing. The vulnerability affects versions prior to 1.30.0 and stems from improper integer arithmetic when computing copy lengths for tensor data, enabling an attacker to trigger buffer overflows by crafting malicious tensor inputs that bypass size validation.
Integer overflow in tensor buffer size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user-level privileges to cause out-of-bounds memory access, leading to information disclosure and denial of service. The vulnerability requires user interaction to process specially crafted large tensor data. CVSS 6.6 indicates moderate severity with local attack vector and high availability impact.
Integer overflow in tensor allocation size calculation within Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause denial of service or memory corruption. The vulnerability arises when processing large tensors, where insufficient memory allocation due to integer wraparound can lead to heap corruption. While CVSS indicates moderate severity (5.3), the high attack complexity and user interaction requirements limit practical exploitation.
BACnet Stack prior to version 1.4.3 exhibits undefined behavior in the decode_signed32() function when processing signed-integer property values containing bytes with the high bit set, causing denial of service through integer overflow. Network-remote attackers can trigger this vulnerability by sending specially crafted BACnet packets with high-bit-set byte sequences, resulting in application instability or crash on embedded systems running vulnerable versions. The vulnerability is confirmed fixed in version 1.4.3.
Storable versions before 3.05 for Perl has a stack overflow. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow in Firefox's Audio/Video Playback component allows remote unauthenticated attackers to cause integrity violations through specially crafted multimedia content. The vulnerability stems from incorrect boundary condition handling in numeric calculations, potentially enabling attackers to modify playback state or corrupt audio/video streams without user interaction. Firefox 150 and later contain the fix.
Incorrect boundary conditions in Firefox's WebRTC component allow remote attackers to read limited memory contents without authentication. Firefox versions prior to 150 are affected by this low-confidentiality vulnerability, which CVSS rates at 5.3 due to network exploitability without user interaction, though CISA's SSVC framework indicates no current exploitation activity and limited technical impact.
Confidentiality compromise in Firefox NSS Libraries allows remote unauthenticated attackers to leak sensitive information over the network without user interaction. The vulnerability affects Firefox 150 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier, and has been patched in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. No public exploit code or active exploitation has been identified at the time of analysis.
Incorrect boundary conditions in Firefox's DOM Device Interfaces component allow remote attackers to cause limited data corruption and browser instability without authentication or user interaction, per CVSS vector AV:N/AC:L/PR:N/UI:N. Vendor-released patches are confirmed in Firefox 150 and Firefox ESR 140.10, with downstream Red Hat and SUSE advisories also issued. No public exploit has been identified at time of analysis, and EPSS at 0.04% (13th percentile) alongside SSVC exploitation status of 'none' indicate low real-world exploitation likelihood despite the moderate CVSS score.
Signed integer overflow in OpenEXR 3.4.0-3.4.9 HTJ2K decompression allows remote attackers to cause denial of service via crafted EXR files with excessive FLOAT channels. The `ht_undo_impl()` function accumulates a bytes-per-line value in a 32-bit signed integer without overflow protection; on memory-permissive systems, the wrapped negative value enables heap out-of-bounds writes. OpenEXR 3.4.10 contains the fix. This is a distinct overflow from CVE-2026-34545 in the same function and mirrors the pattern of CVE-2026-34588.
Out-of-bounds read in wolfSSHd on Windows allows authenticated users to leak adjacent stack memory via malformed terminal resize requests, exposing sensitive data through pseudo-console output. Affects wolfSSH versions prior to 1.5.0. CVSS score of 2.3 reflects low severity due to authentication requirement and limited confidentiality impact; vendor patch available.
Stack-based buffer overflow in Dell PowerProtect Data Domain versions 7.7.1.0-8.6, LTS2025 8.3.1.0-8.3.1.20, and LTS2024 7.13.1.0-7.13.1.60 allows high-privileged local attackers to execute arbitrary commands as root. The vulnerability requires local access and elevated privileges, limiting exposure to insider threats or compromised administrative accounts rather than remote attackers. No public exploit has been identified at time of analysis.
Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers to trigger a temporary denial-of-service condition via crafted network packets to the sx_smpd service. CVSS score is 5.3 (moderate) with confirmed active reporting by JPCERT, though no public exploit code or CISA KEV listing is evident from available data. Attack requires only network access and no authentication or user interaction.
Stack-use-after-return memory corruption in Arduino_Core_STM32 (stm32duino) allows local low-privileged actors to trigger undefined behavior via dangling pointer dereference in interrupt service routines on devices running firmware built with versions prior to 1.7.0. The pwm_start() function stores a stack-allocated TIM_HandleTypeDef pointer in a global HAL timer registry; once the function returns and the stack frame is reclaimed, any timer ISR that fires will dereference a now-invalid pointer, corrupting memory. A researcher disclosure repository (CVE-2026-26399-Disclosure) is publicly referenced, suggesting exploit details exist, though EPSS at 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm no broad active exploitation at time of analysis.
Integer overflow in Little CMS (lcms2) version 2.18 and earlier allows local attackers to trigger a buffer overflow via CubeSize calculation in cmslut.c, where the overflow check occurs after rather than before multiplication. This can result in memory corruption leading to information disclosure or denial of service with low complexity requirements. No active exploitation in CISA KEV confirmed at time of analysis, but proof-of-concept technical details are publicly available.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical USB access to crash the library via malformed PTP protocol data from untrusted camera devices, affecting applications using libgphoto2 for camera enumeration and control on desktop systems.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a USB-connected camera to trigger information disclosure or denial of service via malformed PTP protocol data during Samsung Galaxy device enumeration. The vulnerability exists in `ptp_unpack_OI()` which validates buffer boundaries at 48 bytes but subsequently reads up to 56 bytes, exceeding the boundary by 9 bytes. A fix is available in commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a connected camera to read sensitive memory and potentially cause denial of service via a specially crafted Sony camera device. The vulnerability exists in the Sony-specific PTP packet unpacking function which omits bounds validation present in the standard variant, enabling attackers with direct camera access to trigger information disclosure and minor availability impact.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows physical attackers to disclose sensitive memory and cause denial of service via a malicious PTP (Picture Transfer Protocol) device. The vulnerability exists in the Sony-specific DPD unpacking function, which fails to validate buffer boundaries before reading an enumeration count, enabling attackers with direct device access to craft responses that trigger the out-of-bounds read. Patch is available via upstream commit 3b9f9696be76ae51dca983d9dd8ce586a2561845.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 in the PTP protocol parser allows information disclosure and potential denial of service when processing specially crafted camera responses. The vulnerability exists in ptp_unpack_DPV() where UINT128 and INT128 cases advance the buffer offset by 16 bytes without verifying sufficient buffer remains available, potentially exposing adjacent memory. Exploitation requires physical access to connect a malicious camera device (AV:P), but no special authentication or user interaction is needed once connected. No public exploit code identified at time of analysis.
Missing null terminator in libgphoto2's ptp_unpack_Canon_FE() function allows out-of-bounds memory reads when processing Canon camera filenames. Versions up to 2.5.33 are vulnerable when a 13-byte filename without null termination is supplied, causing subsequent string operations to read beyond buffer boundaries. The vulnerability requires physical camera access and results in information disclosure or denial of service, not remote code execution.
Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a connected camera to read sensitive information from process memory or cause denial of service via malformed EOS event data. Two functions in ptp-pack.c lack length validation, enabling unbounded buffer reads when processing camera events. The vulnerability requires physical device access and is not remotely exploitable, with no public exploit code identified at time of analysis.
Heap-based buffer overflow in xrdp 0.10.5 and earlier allows unauthenticated remote attackers to cause denial of service or memory corruption when the domain_user_separator configuration directive is explicitly enabled in xrdp.ini. An attacker sends a crafted RDP logon request with an excessively long username and domain name combination that overflows an internal buffer, corrupting adjacent memory regions. The vulnerability requires non-default configuration (domain_user_separator must be uncommented) and affects only systems with this setting enabled. Vendor-released patch: version 0.10.6.
Heap-based buffer overflow in libvips up to version 8.18.2 via the deprecated im_minpos_vec function in libvips/deprecated/vips7compat.c allows authenticated local attackers to trigger memory corruption through manipulation of the argument n, with publicly available exploit code confirmed and vendor commitment to remove the deprecated code in libvips 8.19.
Out-of-bounds reads in openCryptoki's BER/DER decoding layer expose Linux and AIX systems to cryptographic service disruption and limited memory disclosure across all token backends. All five primitive decoders in the shared asn1.c library lack buffer-length parameters, accepting attacker-controlled BER length fields without validating them against actual buffer boundaries - a condition reachable via PKCS#11 API operations (C_CreateObject, C_UnwrapKey), token file loading from disk, or remote backend channels (ICSF). Proof-of-concept code exists per SSVC classification, though EPSS sits at 0.01% and no confirmed active exploitation (CISA KEV) has been recorded.
Buffer overflow in the Ruby zlib gem's Zlib::GzipReader allows remote or local attackers supplying crafted gzip data to corrupt process memory via the zstream_buffer_ungets function. Affected versions span all 3.0.x releases through 3.0.0, the 3.1.0-3.1.1 range, and 3.2.0-3.2.1, collectively covering a wide install base across Ruby 3.2 and 3.3 runtime environments. The vulnerability carries an EPSS of 0.04% (13th percentile) and is not listed in CISA KEV, indicating low current exploitation probability despite the memory-corruption class of the flaw.
ONLYOFFICE DocumentServer before 9.3.0 contains an untrusted pointer dereference vulnerability in XLS file processing that enables authenticated remote attackers to leak sensitive memory and bypass ASLR protections. The vulnerability affects XLS conversion workflows through multiple vectors including pictFmla.cbBufInCtlStm manipulation, allowing information disclosure without requiring user interaction. CVSS 5.0 reflects moderate risk given network accessibility and the authentication barrier, though the scope change to CVSS:C indicates potential cross-boundary impact.
Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.
A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).
Information disclosure in Google Chrome prior to version 147.0.7727.101 allows a remote attacker to obtain sensitive information from process memory by enticing a user to open a crafted file. The vulnerability, rated Medium severity by Chrome, resides in the Skia graphics library and is not currently listed in CISA KEV, with a low EPSS exploitation probability (0.03%). A patch is available from Google.
Information disclosure in Google Chrome prior to 147.0.7727.101 allows a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. No public exploit or active exploitation has been identified at this time, and EPSS indicates very low exploitation probability (0.01%).
Buffer overflow in GIMP's file-seattle-filmworks plugin allows denial of service when a user opens a specially crafted Seattle Filmworks file. A remote attacker can deliver the malicious file via email or download, triggering a crash of the plugin and potentially impacting GIMP's stability. No active exploitation or public exploit code has been identified.
Denial of service in GIMP's PVR image loader on Red Hat Enterprise Linux 6 through 9 allows an attacker to crash the application by tricking a user into opening a specially crafted PVR file. The flaw arises from a stack-based buffer overflow and out-of-bounds read, causing the application to terminate unexpectedly. It is not known to be actively exploited; proof-of-concept code has not been publicly identified.
GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.
Denial of service in GIMP allows local attackers to crash the application by tricking a user into opening a malicious TIM image file. The vulnerability resides in the TIM image loader's 4BPP decoding path, where an unconditional stack buffer overflow occurs when processing a specially crafted file, with no impact on confidentiality or integrity. No active exploitation or public exploit is known, and a vendor patch is available.
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Local denial of service in SSSD's PAM passkey responder allows a low-privileged attacker to crash the daemon by sending crafted passkey authentication data, disrupting authentication services on affected Red Hat Enterprise Linux and OpenShift systems. The vulnerability is not known to be actively exploited, and its EPSS score is negligible (0.01%).
Heap-based buffer overflow in Adobe FrameMaker 2022.8 and earlier allows local attackers to disclose sensitive information from process memory without user privileges, requiring only that a victim open a malicious document. CVSS 5.5 reflects confidentiality impact with low attack complexity, though no active exploitation or public proof-of-concept has been confirmed at analysis time.
Out-of-bounds write in Adobe DNG SDK 1.7.1 2502 and earlier causes application denial-of-service through memory corruption when processing malicious DNG files. The vulnerability requires user interaction (opening a crafted file) and affects local attackers on systems where DNG SDK is deployed; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in Windows GDI allows local unauthenticated attackers to disclose sensitive information with user interaction. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, all Windows 11 versions from 22H3 through 26H1, and Windows Server 2012 through 2025. No public exploit code or active exploitation has been confirmed; a vendor patch is available.
Buffer over-read in Windows Kernel Memory allows authenticated local attackers to disclose sensitive kernel information with high confidence. CVE-2026-26169 affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016 through 2025. The vulnerability requires local access and low-level user privileges but does not enable privilege escalation or code execution. Microsoft has released vendor patches addressing the issue across all affected versions.
Out-of-bounds read in Microsoft Office Word enables local information disclosure when a user opens a malicious document, affecting Microsoft 365 Apps for Enterprise and Office LTSC for Mac 2021/2024. The vulnerability requires user interaction (document opening) but does not require elevated privileges, with a CVSS score of 6.1 reflecting moderate severity. Microsoft has released patches addressing this issue across affected product lines.
Heap-based buffer overflow in Windows USB Print Driver allows local privilege escalation via physical device access. Affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, with patch available from Microsoft. Attack requires physical USB access and no user interaction; no public exploit identified at time of analysis.
Out-of-bounds read in Windows GDI (Graphics Device Interface) allows local attackers to disclose sensitive information without authentication. The vulnerability affects Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server 2022/2025, requiring user interaction to trigger. Microsoft has released patches for all affected versions, with specific build numbers provided for remediation.
Microsoft Local Security Authority Subsystem Service (LSASS) information disclosure vulnerability allows authenticated network attackers to read sensitive memory contents via a bounds check bypass in the LSASS process. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. No public exploit code or active exploitation has been reported; vendor-released patches are available across all affected versions.
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows local attackers to cause application denial-of-service by crafting malicious files that trigger memory corruption when opened. This vulnerability requires user interaction to exploit and does not enable code execution or data compromise, making it primarily a disruption vector rather than a critical attack surface despite its moderate CVSS score of 5.5.
Heap-based buffer overflow in Adobe InDesign Desktop versions 21.2 and earlier allows local attackers to disclose sensitive information from memory without authentication, requiring only user interaction to open a malicious file. The vulnerability has a CVSS score of 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been confirmed at time of analysis.
Memory corruption in Python's asyncio introspection and profiling.sampling modules (3.14-3.15) allows a local attacker with high privileges to read and write arbitrary memory in a connected privileged Python process via remote debugging. Exploitation requires persistent, repeated connections and high tolerance for crashes due to ASLR; no public exploit code has been identified. SSVC framework rates technical impact as total, but exploitation remains none-indicating low real-world priority despite severe capability impact.
Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process termination when processing malformed JSON in non-NUL-terminated buffers. All jq releases before commit 2f09060afab23fe9390cce7cb860b10416e1bf5f are affected per CPE cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*. SSVC marks the flaw as automatable with a POC noted, though EPSS sits at only 0.04% and CISA KEV has not listed it, indicating no confirmed widespread exploitation at time of analysis.
Out-of-bounds read in jq release builds allows an attacker who controls filter input to crash the processor or probe process memory by passing a non-string argument to the _strindices builtin. Release builds compiled with -DNDEBUG strip the assert() type guards in jv_string_indexes(), enabling a type confusion that escalates from trivial denial-of-service to a controlled pointer dereference and limited memory read primitive via IEEE-754 bit-pattern manipulation. Publicly available exploit code exists per SSVC; EPSS remains at 0.01% (2nd percentile), indicating no widespread exploitation, and the attack is not in CISA KEV.
Heap out-of-bounds write in ImageMagick's JP2 (JPEG 2000) encoder affects all versions of the 7.x branch below 7.1.2-19 and the 6.x branch below 6.9.13-44, as well as the Magick.NET .NET bindings below 14.12.0. When a user specifies an invalid (zero or negative) subsampling index during JP2 encoding, the subsampling_dx and subsampling_dy parameters are cast to int without clamping, enabling a write beyond the allocated heap buffer. The attack vector is local with required user interaction (AV:L/UI:R), EPSS is 0.01% (2nd percentile), SSVC classifies exploitation as none and non-automatable, and no public exploit or KEV listing exists - placing this firmly in the low-urgency remediation tier for most environments.
Heap write overflow in ImageMagick's JXL encoder crashes the process when 16-bit float encoding is requested, affecting all versions below 7.1.2-19 and Magick.NET NuGet packages below 14.12.0. The overflow writes out-of-bounds to heap memory, causing a denial-of-service condition with no confidentiality or integrity impact. No public exploit has been identified at time of analysis and EPSS sits at 0.01% (2nd percentile), consistent with SSVC assessment of zero active exploitation.
Heap-based buffer overflow in ImageMagick's YAML and JSON encoders allows a local attacker to crash the process by supplying a crafted image file converted to YAML or JSON output format. All ImageMagick versions below 7.1.2-19 are affected, including multiple Magick.NET NuGet packages below 14.12.0. A public proof-of-concept exploit exists, but EPSS remains at 0.01% (2nd percentile) and SSVC classifies exploitation as 'none', indicating no observed active exploitation at time of analysis.
Out-of-bounds read in ImageMagick's -sample resizing operation allows local attackers to crash the process when the sample:offset define is set to a specific value, causing denial of service in versions below 7.1.2-19 and 6.9.13-44. The flaw originates in SampleImage() within MagickCore/resize.c, where a precomputed offset array was used to index into a pixel scanline buffer without adequate bounds enforcement. No public exploit exists and CISA KEV does not list active exploitation; EPSS at 0.01% (2nd percentile) and SSVC exploitation:none confirm this is a low-urgency issue despite its presence in a widely-distributed tool.
Heap-based buffer overflow in ImageMagick's XML parser writes a single out-of-bounds null byte when processing XML content with a zero-length buffer, affecting all ImageMagick releases prior to 7.1.2-19 and 6.9.13-44, and all Magick.NET NuGet packages prior to 14.12.0. The flaw in MagickCore/xml-tree.c allows an unauthenticated remote attacker to crash the ImageMagick process by supplying a crafted XML file, resulting in a denial-of-service condition with no confidentiality or integrity impact confirmed by NVD. No public exploit code is identified at time of analysis, and the EPSS score of 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate very low near-term exploitation probability.
Integer overflow in ImageMagick's despeckle operation corrupts the heap on 32-bit builds, enabling an out-of-bounds write that crashes the process. Affected are ImageMagick before 7.1.2-19 and 6.9.13-44, and all Magick.NET NuGet packages before 14.12.0. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.01% (2nd percentile) and SSVC exploitation status of none confirm this as a low-urgency, patch-when-convenient finding for most organizations.
Integer overflow in OpenJPEG's opj_pi_initialise_encode function (versions 2.5.0-2.5.4) allows authenticated local attackers to trigger availability impact via crafted input to the pi.c library module. The vulnerability has a publicly available proof-of-concept and carries an EPSS score of 0.01% (2nd percentile), reflecting minimal real-world exploitation likelihood despite the presence of exploit code. Patch commit 839936aa33eb8899bbbd80fda02796bb65068951 is available from the vendor.
Out-of-bounds write in Huawei HarmonyOS WEB module allows local attackers without privileges to cause integrity and availability impact through a classic buffer overflow condition. CVSS 5.1 (moderate) reflects local-only attack vector and limited scope, though the vulnerability affects a core web rendering component. No active exploitation or public proof-of-concept confirmed at time of analysis.
Integer overflow in Samsung Open Source Escargot causes undefined behavior and potential denial of service on local systems. The vulnerability affects the Escargot JavaScript engine (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and related versions) and requires local access with low complexity to trigger. With CVSS 5.1 and EPSS not specified, the risk is moderate; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine exposes sensitive memory content to remote attackers through user interaction. The vulnerability affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and allows information disclosure with partial availability impact. CVSS 5.9 (medium) reflects the requirement for user interaction and high complexity attack prerequisites, though the memory exposure potential warrants monitoring for patches.
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine allows local attackers to leak sensitive memory contents and cause denial of service. Affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and potentially other versions; the vulnerability requires local access and specific conditions to trigger but can expose confidential data and crash the application without authentication. No public exploit identified at time of analysis.
Local privilege escalation in HarmonyOS application read module allows unauthenticated local attackers to cause memory corruption through a boundary-unlimited buffer overflow, potentially achieving code execution or system crash with high availability impact. CVSS 6.8 reflects local attack vector with integrity and availability consequences. Huawei has released security bulletins addressing this CWE-119 vulnerability affecting HarmonyOS devices.
Out-of-bounds write in HarmonyOS file system allows local privileged attackers to corrupt memory with high impact on confidentiality, integrity, and availability. The vulnerability affects HarmonyOS across versions and requires high-level local system privileges to exploit, making it a critical concern for multi-user systems and containerized deployments where privilege escalation vectors exist.
Out-of-bounds write vulnerability in Huawei HarmonyOS and EMUI kernel modules allows local privileged attackers to achieve arbitrary memory corruption, potentially compromising system confidentiality and availability. The vulnerability requires high privilege context and nontrivial user interaction to trigger, limiting real-world exploitation scope despite moderate CVSS scoring.
Denial of service in Parani M10 Motorcycle Intercom v2.1.3 via crafted Bluetooth RFCOMM frames allows unauthenticated attackers within wireless range to crash the device. The vulnerability exploits a buffer overflow in the RFCOMM service handler, causing high availability impact. A proof-of-concept exists but active exploitation has not been confirmed; EPSS score of 0.02% suggests limited real-world exploitation pressure despite the accessible attack vector.
Stack overflow in tinyobjloader's experimental MTL file parser (tinyobj_loader_opt.h) allows local attackers to trigger denial of service by supplying a malformed .mtl file. The vulnerability affects the library's material file parsing logic and crashes the application via stack memory corruption, though with EPSS score of 0.01% and no confirmed active exploitation, real-world risk is minimal despite the moderate CVSS 6.2 rating.
BlueAuditor 1.7.2.0 contains a buffer overflow vulnerability in the registration key field that allows local attackers to crash the application by submitting an oversized key value. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.