Buffer Overflow
Monthly
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Heap-based buffer overflow in Microsoft SQL Server allows a low-privileged local attacker to execute arbitrary code with full confidentiality, integrity, and availability impact on the SQL Server host. Affected versions span four major release generations - SQL Server 2017 through 2025 - across both Cumulative Update and GDR servicing tracks, indicating a systemic code path defect rather than an isolated regression. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected builds.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated network attacker with low-level database credentials to achieve full remote code execution on the SQL Server host. The CVSS 8.8 (PR:L) rating reflects that any valid SQL Server login - not just a DBA - can trigger the overflow, making this dangerous in environments with broad user bases or shared credentials. No public exploit has been identified at time of analysis, but patches are available from Microsoft across all affected major versions.
Heap-based buffer overflow in Microsoft SQL Server (2017 through 2025) enables network-reachable, low-privileged authenticated attackers to execute arbitrary code on the database server. With CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), exploitation requires only a valid database login - no administrative privileges or user interaction - making this a credible lateral-movement vector in environments with reachable SQL Server instances. Vendor patches are available across all affected GDR and CU servicing tracks; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2022 and 2025 allows a low-privileged, network-authenticated attacker to achieve remote code execution against the database engine. The vulnerability is reachable over the network with low complexity, requiring only a valid SQL Server login - no elevated privileges or user interaction. Patch has been released by Microsoft across both GDR and Cumulative Update servicing branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2025 allows a network-authenticated low-privileged attacker to achieve remote code execution against affected database instances. Both the GDR servicing branch (below 17.0.1135.8) and the CU8 cumulative update branch (below 17.0.4085.5) are vulnerable. Microsoft has released patches via MSRC; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privilege network attacker to execute arbitrary code on the database host. The vulnerability (CWE-122) resides in a network-reachable code path, requiring only valid SQL Server credentials - no elevated database roles or special configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the full CIA impact and low attack complexity make this a high-priority patching target in enterprise environments.
Remote code execution in Microsoft SQL Server 2025 is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow in the database engine. The flaw (CWE-122) affects both the GDR and CU8 cumulative update branches of SQL Server 2025, requires only a low-privilege database login (PR:L per CVSS), and yields full confidentiality, integrity, and availability impact upon successful exploitation. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release (GDR) servicing tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; vendor patches are available from Microsoft.
Heap-based buffer overflow in Microsoft SQL Server enables a low-privileged authenticated attacker to remotely execute arbitrary code on the database server. All major active SQL Server branches are affected - 2017, 2019, 2022, and the newly released 2025 edition - across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft SQL Server affects versions 2017 through 2025 via an integer overflow that triggers a heap-based buffer overflow in the database engine. An authenticated low-privileged attacker reachable over the network can exploit this flaw to achieve full system compromise - confidentiality, integrity, and availability all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to escalate privileges to full control of the database instance. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Microsoft SQL Server 2017 through 2025 via a heap-based buffer overflow (CWE-122) triggered over a network connection by a low-privileged authenticated attacker. The vulnerability spans all major in-support release branches including GDR and Cumulative Update servicing tracks, with fixed builds identified across eight distinct release configurations. No active exploitation has been confirmed in CISA KEV, but the low attack complexity and broad version coverage make this a high-priority patch target for any organization running SQL Server on the network perimeter or in multi-tenant environments.
Stack-based buffer overflow in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated network attacker with low-level privileges to execute arbitrary code, with scope change enabling impact beyond the SQL Server process itself. The vulnerability carries CVSS 8.5 (S:C) with high confidentiality, integrity, and availability impact, indicating that successful exploitation can compromise not just the database engine but potentially the underlying OS. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though CVSS AC:H reflects meaningful exploitation complexity requiring careful payload construction against modern memory protections.
Denial-of-service via integer overflow in Microsoft SQL Server allows unauthenticated remote attackers to crash the database service over a network connection. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and GDR branches. Microsoft has released patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft SQL Server 2025 is achievable by low-privileged authenticated attackers over the network via a heap-based buffer overflow (CWE-122). Both the GDR (General Distribution Release) and CU8 (Cumulative Update 8) servicing tracks for SQL Server 2025 are affected, spanning version ranges 17.0.1050.2-17.0.1135.8 and 17.0.0.0-17.0.4085.5 respectively. Vendor patches are available through the Microsoft Security Response Center; no public exploit code or active exploitation has been identified at the time of analysis.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in the Microsoft Windows Codecs Library (HEVC Video Extensions) enables local privilege escalation on Windows systems. Three distinct Store app variants - the base edition, the licensed-application edition, and the device-manufacturer-bundled edition - are all affected across specific version ranges. An attacker who can deliver a specially crafted HEVC media file and induce a local user to open it gains full C:H/I:H/A:H impact, effectively achieving code execution at an elevated privilege level. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft HEVC Video Extensions (Windows Codecs Library) enables local code execution with the full privileges of the targeted user when a victim opens or previews a specially crafted HEVC/H.265 video file. Three distinct distribution variants of the codec are affected - the standalone Store app, the device-manufacturer-bundled version, and the licensed-applications edition - all requiring upgrade to their respective patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis, but the user-interaction trigger (opening a video file) creates a viable social engineering vector.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
Guest-to-hypervisor privilege escalation in Xen allows a VM guest with a PCI device assigned - where the device exposes at least one Base Address Register (BAR) mapped to IO port space - to trigger a BUG() assertion in the Xen hypervisor, crashing or potentially compromising the host. The CVSS scope-changed vector (S:C, C:H/I:H/A:H) reflects cross-boundary impact: the attack originates inside a guest VM but affects the host hypervisor. Tracked as XSA-510, no public exploit is identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with a targeted-environment issue rather than mass exploitation.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device.
Remote unauthenticated denial-of-service (and possible memory corruption) in SAP's Extended Passport (EPP) processing library allows an attacker to send a crafted network request with a malformed EPP header, triggering a buffer overflow (CWE-120) that leads to undefined behavior and abnormal program termination. Any SAP application relying on the vulnerable EPP processing component is affected; SAP rates it CVSS 10.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. No public exploit code has been confirmed beyond a source-code reference, and no active exploitation has been reported (CISA KEV absent), though the attack is rated automatable by CISA SSVC.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Buffer overflow in Nordic Semiconductor's nRF Connect SDK Bluetooth CGMS RACP write handler allows an authenticated BLE peer within radio range to overflow a 20-byte static buffer into adjacent BSS memory. Exploitability and exact impact are build-specific: because BSS layout is determined at link time per firmware build, adjacent corrupted data may be security-neutral or may include function pointers or critical control structures enabling code execution or device crash. No public exploit has been identified at time of analysis; the vulnerability was reported through YesWeHack.
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge.
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis.
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint `/boaform/formWanRedirect` fails to validate the length of the `if` argument before copying it into a fixed-size buffer (CWE-120). A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing.
Out-of-bounds heap write in PCRE2 before 10.48 allows memory corruption via the DFA matching engine when a cached workspace block is reused in a recursive context without the size check that guards a freshly allocated block of the same type. Applications that pass attacker-controlled regular expressions to pcre2_dfa_match, or that configure a small heap limit via the PCRE2 API while processing recursive patterns, are exploitable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, PCRE2 10.48 ships a confirmed vendor fix alongside four other security patches in the same release.
Integer-overflow handling in libxml2's xmlIO output path lets a negative length reach application-supplied write callbacks, allowing memory corruption or denial of service in programs that serialize large XML documents. All libxml2 builds before 2.15.4 are affected; the upstream commit 90f293ba adds INT_MAX guards to xmlOutputBufferWrite and xmlOutputBufferFlush and the fix ships in 2.15.4 (also distributed via RHSA-2026:64463). CVSS is 7.3 (AV:L/PR:L), EPSS is only 0.12% (2nd percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Let me produce the JSON. Key facts: libxml2 heap buffer overflow in xmlXPtrEvalXPtrPart due to xmlXPtrEval xpointer length saturation. CVSS 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-122. EPSS 0.13% (3rd percentile). Patch available, fixed in 2.15.4. No KEV, no POC mentioned. Note: CVSS is local vector, PR:L — so authenticated/local access needed. XPointer evaluation requires parsing untrusted XML/XPointer input. Actually the CVSS says AV:L PR:L which suggests local attacker with low privileges — but libxml2 is typically parsed remotely via XML input. There's a tension: the vector says local. I should note that in risk_assessment — conflicting signal. Product name: "libxml2" (2 words? it's one word). Fine. Prevalence: high — libxml2 is widely deployed (core library in many systems). Could argue "ubiquitous". libxml2 is in nearly every Linux distro, used by many apps. I'd say "high" or "ubiquitous". Given anchors: OpenSSL/nginx/Linux kernel = ubiquitous. libxml2 is comparably widespread as a library dependency. I'll say "ubiquitous"? Hmm. It's a core XML parsing library used by GNOME, PHP, Python lxml, many. I'd say "high" to be safe... Actually libxml2 is extremely pervasive. But prevalence is deployment footprint in production. I'll go with "high" with basis "ubiquitous XML parser library across Linux distributions and apps". Hmm, "ubiquitous" anchor is OpenSSL/nginx/kernel. libxml2 is arguably in that class. I'll choose "high" — widely deployed but often not directly network-exposed. Let me pick "high". Actually let me reconsider: libxml2 is bundled in virtually every Linux distro, used by PHP, Python, Ruby, GNOME, etc. That's arguably closer to ubiquitous. But the anchor "high" = widely-deployed enterprise software. I'll go with "high" and basis "core XML parser in most Linux distributions and many apps". Hmm, either is defensible. I'll say "high". assessed_cvss_vector: The vulnerability requires evaluating an XPointer with hostile input. Root cause: len
Let me construct the JSON. Key facts: libxml2 before 2.15.4, xmlSnprintfElements in valid.c, strcat stack buffer overflow, CWE-121. CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS 0.14% (3rd percentile). Patch available from vendor; commit d1686f91. Fix versions: 2.15.4. Red Hat RHSA-2026:64463. No KEV, no POC mentioned. Note the vector AV:L PR:L — local, low privileges. That's interesting because libxml2 is used in parsing. Local vector means the attacker needs to run code that triggers xmlSnprintfElements. Actually the CVSS provided says AV:L/PR:L. Hmm, that seems odd for a library parsing untrusted XML, but I should respect the input. Wait — actually, the input CVSS vector says AV:L/AC:L/PR:L. But note: the "CRITICAL FIELD" instructions say I should not infer auth from description. The vector is provided so I can say PR:L → "authenticated"/local low-privileged. Interesting tension: the vulnerable function is a validation error-message builder. xmlSnprintfElements builds the error message listing expected elements. It's triggered when validation fails on a deeply-nested/large content model — likely reachable via parsing untrusted XML with validation enabled (xmlValidateDocument / well-formedness? Actually valid.c is used for DTD validation). So remote attacks via parsing malicious XML with validation enabled could be possible; the AV:L in the provided vector may be conservative or wrong. I should flag that in risk_assessment — note conflicting signal. I'll write assessed_cvss_vector myself. Should I keep AV:L? The instruction: "Choose PR honestly: if exploitation requires control over configuration files, admin access, or authentication, use PR:H or PR:L — never PR:N for operator/config-dependent flaws. Use AV:L when the vector is local/config-only." Hmm. The vulnerability is in a library parsing XML documents. If an application validates untrusted XML with DTD validation, the buffer overflow could be triggered remotely (AV:N, PR:N, UI:N) in the context
An integer overflow in libxml2's xmlURIEscapeStr() URI-escaping routine, present in all versions before 2.15.4, allows heap memory corruption that can lead to code execution in the context of the process using the library (CVSS 7.8, AV:L/PR:L). The issue is reachable only by a local, low-privileged actor who can drive an oversized string into libxml2's URI handling helpers, and CISA's SSVC rates it non-automatable with no known exploitation. No public exploit code or CISA KEV listing was identified; EPSS is 0.11% (1st percentile), and the fix landed upstream in the 2.15.4 release and in Red Hat errata RHSA-2026:64463.
Heap-based buffer overflow in libxml2 before 2.15.4, reachable through the internal dictionary routine xmlDictAddQString() in dict.c, which miscalculates the size of an exponentially growing string pool and can be driven past the integer range before allocating. Per the vendor-assigned CVSS vector the attack is local with low privileges (AV:L/PR:L), so it primarily affects applications, daemons, or sandboxed services that parse attacker-influenced XML under a constrained account. A vendor patch (2.15.4, commit a4cba4b5) and a Red Hat errata exist, but there is no CISA KEV listing and no confirmed public exploit — EPSS is only 0.12% (2nd percentile), so this is a patch-hygiene item rather than a fire drill.
Heap buffer overflow in ntop nDPI before version 6.0 allows unauthenticated network-adjacent or remote attackers to corrupt process heap memory by sending crafted packets containing TLS SNI values, HTTP headers, or DNS names with characters that expand during JSON escaping. The root cause in ndpi_json_string_escape (src/lib/ndpi_serializer.c) is that the original bounds check guarded only single-byte writes while escape sequences requiring 2 bytes (e.g., backslash-quote) or 6 bytes (e.g., \u00XX control-character escapes) silently overran the caller-supplied buffer. Vendor-released patch is available via commit 94e82c1 targeting the 6.0 release; no public exploit has been identified at time of analysis.
Out-of-bounds write in Unidata netcdf-c through 4.10.1 allows an attacker who can supply a crafted HDF5 file to corrupt process memory when the application enumerates HDF5 attribute names. The vulnerable function NC4_HDF5_inq_attname() in libhdf5/hdf5attr.c blindly copies HDF5-returned attribute names into a fixed 256-byte destination buffer without validating the source length, a classic CWE-787 stack/heap corruption sink. No public exploit code or CISA KEV listing has been identified at time of analysis, but the deterministic nature of the overflow and the wide use of netcdf-c in scientific pipelines make this a meaningful risk for any application that processes externally-sourced HDF5 data.
Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to corrupt application heap memory or terminate the process by delivering a response body larger than twice the Content-Length-derived initial allocation. The flaw resides in http_client.c where the buffer growth logic performed only a single doubling, which is insufficient when the server-supplied Content-Length substantially underestimates the actual body size, causing pj_memcpy() to write beyond the allocation boundary. Only applications using the non-incremental whole-body completion callback are affected; the fix (commit 8d5956a) replaces single-doubling with a loop that guarantees the buffer fits the incoming data before any copy occurs.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Integer underflow leading to heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privilege authenticated access to corrupt memory, potentially achieving arbitrary code execution or full system compromise. IBM has released patches for all four affected major versions; no active exploitation is recorded in CISA KEV and EPSS sits at 0.20% (10th percentile), placing real-world exploitation probability low despite the high CVSS score. SSVC rates this non-automatable with partial technical impact, suggesting the authentication barrier and service specificity meaningfully constrain mass exploitation.
Out-of-bounds write in Hugging Face tokenizers v0.23.1 allows any actor who can supply a crafted tokenizer.json file to abort the loading process immediately, causing denial of service in Rust applications and FFI embeddings before any inference occurs. The defect in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) allocates a scratch buffer sized to the longest vocabulary key, then writes concatenated BPE merge pairs into it without bounding the write to the buffer size; a merge whose result exceeds that length triggers a Rust panic and process abort (CWE-787). A secondary usize underflow at the same code site, activated when continuing_subword_prefix is set and a merge token is shorter than the prefix, produces a panic in debug builds and potential memory corruption in release builds, elevating the secondary impact beyond availability alone. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix appears in the v0.23.2 source.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.
Stack-based buffer over-read in FreeIPMI's ipmi-oem Fujitsu OEM module crashes the client process when a Fujitsu BMC returns a shorter-than-expected response to a System Event Log query. All FreeIPMI versions before 1.6.19 are affected; this is a distinct vulnerability from CVE-2026-50031, which covers different version ranges. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in GNU FreeIPMI before 1.6.19 lets a malicious or compromised Fujitsu iRMC BMC corrupt client memory when the FreeIPMI tooling parses malformed Fujitsu SEL 'long text' responses in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text. Successful exploitation can crash the client or execute arbitrary code in the context of the process reading the System Event Log (typically ipmi-sel or libfreeipmi consumers). No public exploit is identified at time of analysis, and the flaw is fixed in FreeIPMI 1.6.19.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Stack buffer overflow in the uMS graphical operator tool of MOOS ui-moos through commit 50b9c6c allows an unauthenticated network attacker to achieve code execution on an operator workstation by injecting excessively long client or variable names into the MOOSDB pub-sub middleware. When the operator subsequently selects a malicious process list entry or pokes an oversized variable through the uMS interface, unchecked sprintf calls in ScopeTabPane.cpp and ScopeGrid.cpp overflow fixed 1024-byte stack buffers, enabling memory corruption and control-flow hijack. The upstream fix (PR #5, commit a6ebc0bc) is confirmed by direct patch diff evidence replacing all three vulnerable sprintf calls with snprintf; no public exploit code or KEV listing has been identified at time of analysis.
Remote code execution risk in MOOS core-moos through 10.4.0 arises from a pre-authentication heap overflow in MOOSCommPkt packet handling, where a remote attacker declares a negative packet length to write arbitrary data into a four-byte heap buffer during the connection HandShake, before any authentication occurs. Any exposed MOOSDB robotics-middleware instance is affected, and because the flaw is triggered by an attacker-controlled length read straight off the wire, it can be reached with a single crafted packet. No public exploit identified at time of analysis, though the issue was reported and detailed by VulnCheck and a fix is available.
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP function string decoders (FunctionEncoder.cpp / FunctionEncoderMK.cpp), which copy attacker-controlled encoded strings into fixed buffers while trusting declared length fields and scanning for delimiters without any bounds or end-of-string checks. Any actor able to publish a crafted value to a MOOS variable (via the typically unauthenticated MOOSDB) or supply a malicious .alog file can overflow these buffers, potentially achieving code execution on the autonomy stack of a marine vehicle. Publicly available exploit code exists per the VulnCheck advisory; there is no public exploit identified in CISA KEV, so it is not confirmed as actively exploited.
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds heap read during .DSB file parsing in DASYLab (all versions prior to 2026.0.0) allows an attacker who can persuade a user to open a specially crafted data file to potentially disclose heap memory contents and crash the application. The root cause is CWE-125: insufficient validation of user-supplied length or offset fields during file-handling routines, causing reads a few bytes past an allocated heap buffer boundary. No public exploit code or active exploitation has been identified at time of analysis; vendor-released patch is version 2026.0.0.
Out-of-bounds write in DASYLab (all versions before 2026.0.0) enables arbitrary code execution when a victim opens a specially crafted .DSB worksheet file. The flaw, CWE-787, stems from improper validation of user-supplied data within the .DSB file parser, permitting writes past the end of an allocated data structure and corrupting adjacent memory. No public exploit or active exploitation has been identified at time of analysis; successful exploitation requires social-engineering the target into opening a malicious file.
Out-of-bounds heap write in DASYLab before version 2026.0.0 enables arbitrary code execution on the victim's system when a user opens a maliciously crafted .DSB worksheet file. The flaw stems from insufficient validation of user-supplied data during .DSB file parsing, allowing an attacker to write past the end of an allocated heap buffer (CWE-787). All versions of DASYLab prior to 2026.0.0 are affected, and exploitation relies entirely on convincing a user to open a weaponized file; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds write in DASYLab's .DSB worksheet file parser allows an attacker to achieve code execution with full confidentiality, integrity, and availability impact by convincing a user to open a crafted file. All versions of DASYLab prior to 2026.0.0, as published by MeasX (formerly National Instruments), are affected. No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Remote code execution in Google Chrome for Android before 152.0.7977.82 stems from an out-of-bounds write in the WebGL implementation, letting a remote attacker escape the browser sandbox and run arbitrary code simply by luring a victim to a crafted HTML page. Rated Chromium severity High and CVSS 9.6, the flaw is notable because exploitation breaks out of the renderer sandbox rather than being contained by it. There is no public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none.
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's security context when a victim opens a specially crafted malicious file. The vulnerability resides in file-parsing logic (CWE-122), and successful exploitation grants full C:H/I:H/A:H impact without requiring elevated privileges on the victim's system. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has released a security advisory (APSB26-121) addressing the issue.
Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to overflow memory in the Boa embedded web server's WLAN configuration handler, potentially achieving arbitrary code execution. The vulnerable parameter is `ssid` within the `/boaform/formWlanSetup` endpoint, which lacks input length validation per CWE-120. A public proof-of-concept is hosted on GitHub, concretely lowering the exploitation bar; no vendor patch has been identified at time of analysis.
Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists.
Remote code execution in Rockwell Automation Arena's DOE file parser allows a network-reachable attacker to write beyond the boundary of an allocated object and execute arbitrary code within the context of the running Arena process. Affected users must be socially engineered into opening a maliciously crafted Design of Experiments (DOE) file or visiting a page that triggers the parse. The CVSS 4.0 score of 7.5 reflects high attack complexity and mandatory active user interaction, reducing real-world exploitability despite the high-severity memory corruption impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds buffer access in the Linux kernel's synaptics-rmi4 driver exposes systems with Synaptics RMI4 touchpad hardware to kernel memory corruption triggered by a copy-paste typo in F55 electrode initialization. On affected hardware where the receiver (RX) electrode count exceeds the transmitter (TX) count, the incorrectly propagated TX value causes F54 diagnostic routines to calculate an inflated report buffer size, enabling potential OOB reads or writes in kernel space. Patched stable releases are available across all maintained kernel branches; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS remains at 0.21%.
Out-of-bounds memory access in the Linux kernel's Loongson2 MMC driver allows a local authenticated user to corrupt kernel memory through incorrect scatterlist indexing in the mmc: loongson2 subsystem. The functions `ls2k0500_mmc_reorder_cmd_data()` and `ls2k2000_mmc_reorder_cmd_data()` use `for_each_sg()` to iterate a scatterlist but then incorrectly re-index the current `sg` pointer as if it were an array base (using `&sg[i]`), causing access to wrong or out-of-bounds scatterlist entries. This memory corruption can lead to full kernel compromise - confidentiality, integrity, and availability loss - on systems using Loongson LS2K0500 or LS2K2000 SoCs equipped with MMC storage. No public exploit has been identified at time of analysis.
Out-of-bounds memory reads in the Linux kernel's drm/amdkfd CRAT table parser allow a local attacker to leak kernel memory and potentially crash the system on AMD GPU/APU-equipped hosts. The CRAT (Component Resource Affinity Table) subtype parser validates that a subtype header fits within the image buffer but fails to verify that the advertised subtype length field also stays within bounds, enabling kfd_parse_subtype() to cast the header pointer beyond valid memory when a malformed CRAT table is supplied. No public exploit has been identified at time of analysis; EPSS is 0.19%, placing this in the 9th percentile.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Heap-based buffer overflow in Microsoft SQL Server allows a low-privileged local attacker to execute arbitrary code with full confidentiality, integrity, and availability impact on the SQL Server host. Affected versions span four major release generations - SQL Server 2017 through 2025 - across both Cumulative Update and GDR servicing tracks, indicating a systemic code path defect rather than an isolated regression. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected builds.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated network attacker with low-level database credentials to achieve full remote code execution on the SQL Server host. The CVSS 8.8 (PR:L) rating reflects that any valid SQL Server login - not just a DBA - can trigger the overflow, making this dangerous in environments with broad user bases or shared credentials. No public exploit has been identified at time of analysis, but patches are available from Microsoft across all affected major versions.
Heap-based buffer overflow in Microsoft SQL Server (2017 through 2025) enables network-reachable, low-privileged authenticated attackers to execute arbitrary code on the database server. With CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), exploitation requires only a valid database login - no administrative privileges or user interaction - making this a credible lateral-movement vector in environments with reachable SQL Server instances. Vendor patches are available across all affected GDR and CU servicing tracks; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2022 and 2025 allows a low-privileged, network-authenticated attacker to achieve remote code execution against the database engine. The vulnerability is reachable over the network with low complexity, requiring only a valid SQL Server login - no elevated privileges or user interaction. Patch has been released by Microsoft across both GDR and Cumulative Update servicing branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2025 allows a network-authenticated low-privileged attacker to achieve remote code execution against affected database instances. Both the GDR servicing branch (below 17.0.1135.8) and the CU8 cumulative update branch (below 17.0.4085.5) are vulnerable. Microsoft has released patches via MSRC; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privilege network attacker to execute arbitrary code on the database host. The vulnerability (CWE-122) resides in a network-reachable code path, requiring only valid SQL Server credentials - no elevated database roles or special configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the full CIA impact and low attack complexity make this a high-priority patching target in enterprise environments.
Remote code execution in Microsoft SQL Server 2025 is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow in the database engine. The flaw (CWE-122) affects both the GDR and CU8 cumulative update branches of SQL Server 2025, requires only a low-privilege database login (PR:L per CVSS), and yields full confidentiality, integrity, and availability impact upon successful exploitation. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release (GDR) servicing tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; vendor patches are available from Microsoft.
Heap-based buffer overflow in Microsoft SQL Server enables a low-privileged authenticated attacker to remotely execute arbitrary code on the database server. All major active SQL Server branches are affected - 2017, 2019, 2022, and the newly released 2025 edition - across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft SQL Server affects versions 2017 through 2025 via an integer overflow that triggers a heap-based buffer overflow in the database engine. An authenticated low-privileged attacker reachable over the network can exploit this flaw to achieve full system compromise - confidentiality, integrity, and availability all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to escalate privileges to full control of the database instance. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Microsoft SQL Server 2017 through 2025 via a heap-based buffer overflow (CWE-122) triggered over a network connection by a low-privileged authenticated attacker. The vulnerability spans all major in-support release branches including GDR and Cumulative Update servicing tracks, with fixed builds identified across eight distinct release configurations. No active exploitation has been confirmed in CISA KEV, but the low attack complexity and broad version coverage make this a high-priority patch target for any organization running SQL Server on the network perimeter or in multi-tenant environments.
Stack-based buffer overflow in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated network attacker with low-level privileges to execute arbitrary code, with scope change enabling impact beyond the SQL Server process itself. The vulnerability carries CVSS 8.5 (S:C) with high confidentiality, integrity, and availability impact, indicating that successful exploitation can compromise not just the database engine but potentially the underlying OS. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though CVSS AC:H reflects meaningful exploitation complexity requiring careful payload construction against modern memory protections.
Denial-of-service via integer overflow in Microsoft SQL Server allows unauthenticated remote attackers to crash the database service over a network connection. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and GDR branches. Microsoft has released patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft SQL Server 2025 is achievable by low-privileged authenticated attackers over the network via a heap-based buffer overflow (CWE-122). Both the GDR (General Distribution Release) and CU8 (Cumulative Update 8) servicing tracks for SQL Server 2025 are affected, spanning version ranges 17.0.1050.2-17.0.1135.8 and 17.0.0.0-17.0.4085.5 respectively. Vendor patches are available through the Microsoft Security Response Center; no public exploit code or active exploitation has been identified at the time of analysis.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in the Microsoft Windows Codecs Library (HEVC Video Extensions) enables local privilege escalation on Windows systems. Three distinct Store app variants - the base edition, the licensed-application edition, and the device-manufacturer-bundled edition - are all affected across specific version ranges. An attacker who can deliver a specially crafted HEVC media file and induce a local user to open it gains full C:H/I:H/A:H impact, effectively achieving code execution at an elevated privilege level. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft HEVC Video Extensions (Windows Codecs Library) enables local code execution with the full privileges of the targeted user when a victim opens or previews a specially crafted HEVC/H.265 video file. Three distinct distribution variants of the codec are affected - the standalone Store app, the device-manufacturer-bundled version, and the licensed-applications edition - all requiring upgrade to their respective patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis, but the user-interaction trigger (opening a video file) creates a viable social engineering vector.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
Guest-to-hypervisor privilege escalation in Xen allows a VM guest with a PCI device assigned - where the device exposes at least one Base Address Register (BAR) mapped to IO port space - to trigger a BUG() assertion in the Xen hypervisor, crashing or potentially compromising the host. The CVSS scope-changed vector (S:C, C:H/I:H/A:H) reflects cross-boundary impact: the attack originates inside a guest VM but affects the host hypervisor. Tracked as XSA-510, no public exploit is identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with a targeted-environment issue rather than mass exploitation.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device.
Remote unauthenticated denial-of-service (and possible memory corruption) in SAP's Extended Passport (EPP) processing library allows an attacker to send a crafted network request with a malformed EPP header, triggering a buffer overflow (CWE-120) that leads to undefined behavior and abnormal program termination. Any SAP application relying on the vulnerable EPP processing component is affected; SAP rates it CVSS 10.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. No public exploit code has been confirmed beyond a source-code reference, and no active exploitation has been reported (CISA KEV absent), though the attack is rated automatable by CISA SSVC.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Buffer overflow in Nordic Semiconductor's nRF Connect SDK Bluetooth CGMS RACP write handler allows an authenticated BLE peer within radio range to overflow a 20-byte static buffer into adjacent BSS memory. Exploitability and exact impact are build-specific: because BSS layout is determined at link time per firmware build, adjacent corrupted data may be security-neutral or may include function pointers or critical control structures enabling code execution or device crash. No public exploit has been identified at time of analysis; the vulnerability was reported through YesWeHack.
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge.
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis.
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint `/boaform/formWanRedirect` fails to validate the length of the `if` argument before copying it into a fixed-size buffer (CWE-120). A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing.
Out-of-bounds heap write in PCRE2 before 10.48 allows memory corruption via the DFA matching engine when a cached workspace block is reused in a recursive context without the size check that guards a freshly allocated block of the same type. Applications that pass attacker-controlled regular expressions to pcre2_dfa_match, or that configure a small heap limit via the PCRE2 API while processing recursive patterns, are exploitable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, PCRE2 10.48 ships a confirmed vendor fix alongside four other security patches in the same release.
Integer-overflow handling in libxml2's xmlIO output path lets a negative length reach application-supplied write callbacks, allowing memory corruption or denial of service in programs that serialize large XML documents. All libxml2 builds before 2.15.4 are affected; the upstream commit 90f293ba adds INT_MAX guards to xmlOutputBufferWrite and xmlOutputBufferFlush and the fix ships in 2.15.4 (also distributed via RHSA-2026:64463). CVSS is 7.3 (AV:L/PR:L), EPSS is only 0.12% (2nd percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Let me produce the JSON. Key facts: libxml2 heap buffer overflow in xmlXPtrEvalXPtrPart due to xmlXPtrEval xpointer length saturation. CVSS 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-122. EPSS 0.13% (3rd percentile). Patch available, fixed in 2.15.4. No KEV, no POC mentioned. Note: CVSS is local vector, PR:L — so authenticated/local access needed. XPointer evaluation requires parsing untrusted XML/XPointer input. Actually the CVSS says AV:L PR:L which suggests local attacker with low privileges — but libxml2 is typically parsed remotely via XML input. There's a tension: the vector says local. I should note that in risk_assessment — conflicting signal. Product name: "libxml2" (2 words? it's one word). Fine. Prevalence: high — libxml2 is widely deployed (core library in many systems). Could argue "ubiquitous". libxml2 is in nearly every Linux distro, used by many apps. I'd say "high" or "ubiquitous". Given anchors: OpenSSL/nginx/Linux kernel = ubiquitous. libxml2 is comparably widespread as a library dependency. I'll say "ubiquitous"? Hmm. It's a core XML parsing library used by GNOME, PHP, Python lxml, many. I'd say "high" to be safe... Actually libxml2 is extremely pervasive. But prevalence is deployment footprint in production. I'll go with "high" with basis "ubiquitous XML parser library across Linux distributions and apps". Hmm, "ubiquitous" anchor is OpenSSL/nginx/kernel. libxml2 is arguably in that class. I'll choose "high" — widely deployed but often not directly network-exposed. Let me pick "high". Actually let me reconsider: libxml2 is bundled in virtually every Linux distro, used by PHP, Python, Ruby, GNOME, etc. That's arguably closer to ubiquitous. But the anchor "high" = widely-deployed enterprise software. I'll go with "high" and basis "core XML parser in most Linux distributions and many apps". Hmm, either is defensible. I'll say "high". assessed_cvss_vector: The vulnerability requires evaluating an XPointer with hostile input. Root cause: len
Let me construct the JSON. Key facts: libxml2 before 2.15.4, xmlSnprintfElements in valid.c, strcat stack buffer overflow, CWE-121. CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS 0.14% (3rd percentile). Patch available from vendor; commit d1686f91. Fix versions: 2.15.4. Red Hat RHSA-2026:64463. No KEV, no POC mentioned. Note the vector AV:L PR:L — local, low privileges. That's interesting because libxml2 is used in parsing. Local vector means the attacker needs to run code that triggers xmlSnprintfElements. Actually the CVSS provided says AV:L/PR:L. Hmm, that seems odd for a library parsing untrusted XML, but I should respect the input. Wait — actually, the input CVSS vector says AV:L/AC:L/PR:L. But note: the "CRITICAL FIELD" instructions say I should not infer auth from description. The vector is provided so I can say PR:L → "authenticated"/local low-privileged. Interesting tension: the vulnerable function is a validation error-message builder. xmlSnprintfElements builds the error message listing expected elements. It's triggered when validation fails on a deeply-nested/large content model — likely reachable via parsing untrusted XML with validation enabled (xmlValidateDocument / well-formedness? Actually valid.c is used for DTD validation). So remote attacks via parsing malicious XML with validation enabled could be possible; the AV:L in the provided vector may be conservative or wrong. I should flag that in risk_assessment — note conflicting signal. I'll write assessed_cvss_vector myself. Should I keep AV:L? The instruction: "Choose PR honestly: if exploitation requires control over configuration files, admin access, or authentication, use PR:H or PR:L — never PR:N for operator/config-dependent flaws. Use AV:L when the vector is local/config-only." Hmm. The vulnerability is in a library parsing XML documents. If an application validates untrusted XML with DTD validation, the buffer overflow could be triggered remotely (AV:N, PR:N, UI:N) in the context
An integer overflow in libxml2's xmlURIEscapeStr() URI-escaping routine, present in all versions before 2.15.4, allows heap memory corruption that can lead to code execution in the context of the process using the library (CVSS 7.8, AV:L/PR:L). The issue is reachable only by a local, low-privileged actor who can drive an oversized string into libxml2's URI handling helpers, and CISA's SSVC rates it non-automatable with no known exploitation. No public exploit code or CISA KEV listing was identified; EPSS is 0.11% (1st percentile), and the fix landed upstream in the 2.15.4 release and in Red Hat errata RHSA-2026:64463.
Heap-based buffer overflow in libxml2 before 2.15.4, reachable through the internal dictionary routine xmlDictAddQString() in dict.c, which miscalculates the size of an exponentially growing string pool and can be driven past the integer range before allocating. Per the vendor-assigned CVSS vector the attack is local with low privileges (AV:L/PR:L), so it primarily affects applications, daemons, or sandboxed services that parse attacker-influenced XML under a constrained account. A vendor patch (2.15.4, commit a4cba4b5) and a Red Hat errata exist, but there is no CISA KEV listing and no confirmed public exploit — EPSS is only 0.12% (2nd percentile), so this is a patch-hygiene item rather than a fire drill.
Heap buffer overflow in ntop nDPI before version 6.0 allows unauthenticated network-adjacent or remote attackers to corrupt process heap memory by sending crafted packets containing TLS SNI values, HTTP headers, or DNS names with characters that expand during JSON escaping. The root cause in ndpi_json_string_escape (src/lib/ndpi_serializer.c) is that the original bounds check guarded only single-byte writes while escape sequences requiring 2 bytes (e.g., backslash-quote) or 6 bytes (e.g., \u00XX control-character escapes) silently overran the caller-supplied buffer. Vendor-released patch is available via commit 94e82c1 targeting the 6.0 release; no public exploit has been identified at time of analysis.
Out-of-bounds write in Unidata netcdf-c through 4.10.1 allows an attacker who can supply a crafted HDF5 file to corrupt process memory when the application enumerates HDF5 attribute names. The vulnerable function NC4_HDF5_inq_attname() in libhdf5/hdf5attr.c blindly copies HDF5-returned attribute names into a fixed 256-byte destination buffer without validating the source length, a classic CWE-787 stack/heap corruption sink. No public exploit code or CISA KEV listing has been identified at time of analysis, but the deterministic nature of the overflow and the wide use of netcdf-c in scientific pipelines make this a meaningful risk for any application that processes externally-sourced HDF5 data.
Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to corrupt application heap memory or terminate the process by delivering a response body larger than twice the Content-Length-derived initial allocation. The flaw resides in http_client.c where the buffer growth logic performed only a single doubling, which is insufficient when the server-supplied Content-Length substantially underestimates the actual body size, causing pj_memcpy() to write beyond the allocation boundary. Only applications using the non-incremental whole-body completion callback are affected; the fix (commit 8d5956a) replaces single-doubling with a loop that guarantees the buffer fits the incoming data before any copy occurs.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Integer underflow leading to heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privilege authenticated access to corrupt memory, potentially achieving arbitrary code execution or full system compromise. IBM has released patches for all four affected major versions; no active exploitation is recorded in CISA KEV and EPSS sits at 0.20% (10th percentile), placing real-world exploitation probability low despite the high CVSS score. SSVC rates this non-automatable with partial technical impact, suggesting the authentication barrier and service specificity meaningfully constrain mass exploitation.
Out-of-bounds write in Hugging Face tokenizers v0.23.1 allows any actor who can supply a crafted tokenizer.json file to abort the loading process immediately, causing denial of service in Rust applications and FFI embeddings before any inference occurs. The defect in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) allocates a scratch buffer sized to the longest vocabulary key, then writes concatenated BPE merge pairs into it without bounding the write to the buffer size; a merge whose result exceeds that length triggers a Rust panic and process abort (CWE-787). A secondary usize underflow at the same code site, activated when continuing_subword_prefix is set and a merge token is shorter than the prefix, produces a panic in debug builds and potential memory corruption in release builds, elevating the secondary impact beyond availability alone. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix appears in the v0.23.2 source.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.
Stack-based buffer over-read in FreeIPMI's ipmi-oem Fujitsu OEM module crashes the client process when a Fujitsu BMC returns a shorter-than-expected response to a System Event Log query. All FreeIPMI versions before 1.6.19 are affected; this is a distinct vulnerability from CVE-2026-50031, which covers different version ranges. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in GNU FreeIPMI before 1.6.19 lets a malicious or compromised Fujitsu iRMC BMC corrupt client memory when the FreeIPMI tooling parses malformed Fujitsu SEL 'long text' responses in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text. Successful exploitation can crash the client or execute arbitrary code in the context of the process reading the System Event Log (typically ipmi-sel or libfreeipmi consumers). No public exploit is identified at time of analysis, and the flaw is fixed in FreeIPMI 1.6.19.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Stack buffer overflow in the uMS graphical operator tool of MOOS ui-moos through commit 50b9c6c allows an unauthenticated network attacker to achieve code execution on an operator workstation by injecting excessively long client or variable names into the MOOSDB pub-sub middleware. When the operator subsequently selects a malicious process list entry or pokes an oversized variable through the uMS interface, unchecked sprintf calls in ScopeTabPane.cpp and ScopeGrid.cpp overflow fixed 1024-byte stack buffers, enabling memory corruption and control-flow hijack. The upstream fix (PR #5, commit a6ebc0bc) is confirmed by direct patch diff evidence replacing all three vulnerable sprintf calls with snprintf; no public exploit code or KEV listing has been identified at time of analysis.
Remote code execution risk in MOOS core-moos through 10.4.0 arises from a pre-authentication heap overflow in MOOSCommPkt packet handling, where a remote attacker declares a negative packet length to write arbitrary data into a four-byte heap buffer during the connection HandShake, before any authentication occurs. Any exposed MOOSDB robotics-middleware instance is affected, and because the flaw is triggered by an attacker-controlled length read straight off the wire, it can be reached with a single crafted packet. No public exploit identified at time of analysis, though the issue was reported and detailed by VulnCheck and a fix is available.
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP function string decoders (FunctionEncoder.cpp / FunctionEncoderMK.cpp), which copy attacker-controlled encoded strings into fixed buffers while trusting declared length fields and scanning for delimiters without any bounds or end-of-string checks. Any actor able to publish a crafted value to a MOOS variable (via the typically unauthenticated MOOSDB) or supply a malicious .alog file can overflow these buffers, potentially achieving code execution on the autonomy stack of a marine vehicle. Publicly available exploit code exists per the VulnCheck advisory; there is no public exploit identified in CISA KEV, so it is not confirmed as actively exploited.
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds heap read during .DSB file parsing in DASYLab (all versions prior to 2026.0.0) allows an attacker who can persuade a user to open a specially crafted data file to potentially disclose heap memory contents and crash the application. The root cause is CWE-125: insufficient validation of user-supplied length or offset fields during file-handling routines, causing reads a few bytes past an allocated heap buffer boundary. No public exploit code or active exploitation has been identified at time of analysis; vendor-released patch is version 2026.0.0.
Out-of-bounds write in DASYLab (all versions before 2026.0.0) enables arbitrary code execution when a victim opens a specially crafted .DSB worksheet file. The flaw, CWE-787, stems from improper validation of user-supplied data within the .DSB file parser, permitting writes past the end of an allocated data structure and corrupting adjacent memory. No public exploit or active exploitation has been identified at time of analysis; successful exploitation requires social-engineering the target into opening a malicious file.
Out-of-bounds heap write in DASYLab before version 2026.0.0 enables arbitrary code execution on the victim's system when a user opens a maliciously crafted .DSB worksheet file. The flaw stems from insufficient validation of user-supplied data during .DSB file parsing, allowing an attacker to write past the end of an allocated heap buffer (CWE-787). All versions of DASYLab prior to 2026.0.0 are affected, and exploitation relies entirely on convincing a user to open a weaponized file; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds write in DASYLab's .DSB worksheet file parser allows an attacker to achieve code execution with full confidentiality, integrity, and availability impact by convincing a user to open a crafted file. All versions of DASYLab prior to 2026.0.0, as published by MeasX (formerly National Instruments), are affected. No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Remote code execution in Google Chrome for Android before 152.0.7977.82 stems from an out-of-bounds write in the WebGL implementation, letting a remote attacker escape the browser sandbox and run arbitrary code simply by luring a victim to a crafted HTML page. Rated Chromium severity High and CVSS 9.6, the flaw is notable because exploitation breaks out of the renderer sandbox rather than being contained by it. There is no public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none.
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's security context when a victim opens a specially crafted malicious file. The vulnerability resides in file-parsing logic (CWE-122), and successful exploitation grants full C:H/I:H/A:H impact without requiring elevated privileges on the victim's system. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has released a security advisory (APSB26-121) addressing the issue.
Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to overflow memory in the Boa embedded web server's WLAN configuration handler, potentially achieving arbitrary code execution. The vulnerable parameter is `ssid` within the `/boaform/formWlanSetup` endpoint, which lacks input length validation per CWE-120. A public proof-of-concept is hosted on GitHub, concretely lowering the exploitation bar; no vendor patch has been identified at time of analysis.
Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists.
Remote code execution in Rockwell Automation Arena's DOE file parser allows a network-reachable attacker to write beyond the boundary of an allocated object and execute arbitrary code within the context of the running Arena process. Affected users must be socially engineered into opening a maliciously crafted Design of Experiments (DOE) file or visiting a page that triggers the parse. The CVSS 4.0 score of 7.5 reflects high attack complexity and mandatory active user interaction, reducing real-world exploitability despite the high-severity memory corruption impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds buffer access in the Linux kernel's synaptics-rmi4 driver exposes systems with Synaptics RMI4 touchpad hardware to kernel memory corruption triggered by a copy-paste typo in F55 electrode initialization. On affected hardware where the receiver (RX) electrode count exceeds the transmitter (TX) count, the incorrectly propagated TX value causes F54 diagnostic routines to calculate an inflated report buffer size, enabling potential OOB reads or writes in kernel space. Patched stable releases are available across all maintained kernel branches; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS remains at 0.21%.
Out-of-bounds memory access in the Linux kernel's Loongson2 MMC driver allows a local authenticated user to corrupt kernel memory through incorrect scatterlist indexing in the mmc: loongson2 subsystem. The functions `ls2k0500_mmc_reorder_cmd_data()` and `ls2k2000_mmc_reorder_cmd_data()` use `for_each_sg()` to iterate a scatterlist but then incorrectly re-index the current `sg` pointer as if it were an array base (using `&sg[i]`), causing access to wrong or out-of-bounds scatterlist entries. This memory corruption can lead to full kernel compromise - confidentiality, integrity, and availability loss - on systems using Loongson LS2K0500 or LS2K2000 SoCs equipped with MMC storage. No public exploit has been identified at time of analysis.
Out-of-bounds memory reads in the Linux kernel's drm/amdkfd CRAT table parser allow a local attacker to leak kernel memory and potentially crash the system on AMD GPU/APU-equipped hosts. The CRAT (Component Resource Affinity Table) subtype parser validates that a subtype header fits within the image buffer but fails to verify that the advertised subtype length field also stays within bounds, enabling kfd_parse_subtype() to cast the header pointer beyond valid memory when a malformed CRAT table is supplied. No public exploit has been identified at time of analysis; EPSS is 0.19%, placing this in the 9th percentile.