Buffer Overflow
Monthly
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Modem, there is a possible out of bounds write due to a heap buffer overflow. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Modem, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In ims service, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while accessing a buffer during IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing large input data from a remote source via a communication interface. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while processing message from client with invalid payload. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption when triggering a subsystem crash with an out-of-range identifier. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing client message during device management. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing request sent from GVM. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing audio streaming operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing a GP command response. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while performing encryption and decryption commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while registering commands from clients with diag through diagHal. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A buffer overflow was addressed with improved bounds checking. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved input validation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A buffer overflow was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer overflow vulnerability (CWE-119) in Apple's HID (Human Interface Device) subsystem affecting macOS Tahoe, iOS, and iPadOS that allows a malicious or compromised HID device to trigger an unexpected process crash, resulting in denial of service. The vulnerability requires adjacent network access and no user interaction, but does not compromise confidentiality or integrity. Apple has patched this issue in version 26.1 across affected platforms.
Multiple issues were addressed by disabling array allocation sinking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write issue was addressed with improved input validation. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved bounds checking. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved bounds checking. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was determined in Tenda AC10 16.03.10.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Tenda A15 15.13.07.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Tenda AC8 16.03.34.06. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was identified in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
/etc/timezone can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
/etc/avahi/services/z9.service can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Stack-based buffer overflow in QEMU's e1000 network device emulation allows local guest users to crash the QEMU process via crafted short frames in loopback mode, causing denial of service on the host. The vulnerability exists in the e1000_receive_iov() function where frame padding logic was removed from the device layer but loopback mode still processes short frames unsafely. No public exploit code or active exploitation in KEV has been reported at time of analysis.
Denial of service in the Tenda AC8 dual-band gigabit router (hardware revision v03.03.10.01) allows a remote attacker to crash the device by sending a single crafted packet to its UPnP service, triggering a stack-based buffer overflow (CWE-121). The flaw requires no authentication or user interaction per the CVSS vector (PR:N/UI:N) and impacts availability only (A:H, no confidentiality/integrity impact). Publicly available exploit material exists via a researcher GitHub repository, though the issue is not listed in CISA KEV and carries a modest EPSS score of 0.39% (31st percentile).
Out-of-bounds memory read in the Linux kernel's hfsplus filesystem driver (fixed in 6.17-rc series) allows a local user to leak adjacent slab memory and crash the system when the kernel parses a maliciously crafted HFS+ volume. The flaw lives in hfsplus_strcasecmp() during B-tree catalog record comparison and is reached through ordinary path lookup on a mounted HFS+ image. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with a local, filesystem-parsing memory-safety bug rather than a remotely weaponizable one.
Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.
Use-after-free in X.Org X server and Xwayland during Present extension notification processing allows local authenticated users to achieve arbitrary code execution or denial of service. The flaw affects core display server components across multiple Linux distributions, with Red Hat confirming patches through 15 security advisories (RHSA-2025:19432 through RHSA-2025:22055). CVSS 7.3 reflects high integrity and availability impact with low confidentiality impact. No active exploitation confirmed (not in CISA KEV). EPSS data not provided, but the local attack vector and authentication requirement reduce remote exploitation risk despite the severity of potential impact.
Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).
Out-of-bounds slab read in the Linux kernel's HFS+ filesystem driver (fs/hfsplus/unicode.c) allows a local low-privileged attacker to read adjacent kernel heap memory by triggering hfsplus_uni2asc() through the listxattr() path on a crafted/malformed HFS+ image. Because hfsplus_listxattr() passes a struct hfsplus_attr_unistr* whose layout differs from the struct hfsplus_unistr* the earlier fix (commit 94458781aee6) assumed, an oversized ustrlen drives the Unicode buffer pointer past the allocation. There is no public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a memory-disclosure primitive requiring local filesystem access rather than remote mass exploitation.
Local privilege escalation potential in the Linux kernel's ARM Statistical Profiling Extension (arm_spe) perf driver stems from an integer overflow in the PERF_IDX2OFF() calculation when an AUX ring buffer of 2 GiB or larger is used. On affected arm64 systems, a local user with permission to open SPE perf events can trigger the overflow because nr_pages was not cast to unsigned long, producing an incorrect buffer offset and out-of-bounds kernel memory access. This is a resolved kernel bug fixed via stable-tree commits; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%, 10th percentile).
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Out-of-bounds/use-after-free read in the Linux kernel UDF (Universal Disk Format) filesystem driver allows a local attacker to crash the kernel or leak adjacent memory by getting a crafted or corrupted UDF image mounted and accessed. The flaw lies in fs/udf handling of the on-disk lengthAllocDescs field, which was not validated against the block size, causing udf_update_tag() to invoke crc_itu_t() on memory past the buffer. It was found by the Linux Verification Center via Syzkaller; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Use-after-free vulnerability in Kamailio 5.5.0 configuration file parser allows local authenticated attackers to cause denial of service or memory corruption via malformed configuration files. The vulnerability exists in the sr_push_yy_state function within the lexical analyzer (cfg.lex) and has publicly available exploit code, though the vendor has not responded to disclosure and practical exploitability remains uncertain due to the requirement for direct configuration file manipulation.
Heap-based buffer overflow in Kamailio 5.5.0's rve_destroy function allows local authenticated attackers to cause limited data corruption through manipulation of configuration files, with publicly available exploit code but extremely low real-world risk due to local access requirement, authenticated privilege level, and acknowledged uncertainty about vulnerability existence.
Arbitrary file read in PerfreeBlog v4.0.11 allows unauthenticated remote attackers to read files outside the intended web root by bypassing path validation in the validThemeFilePath function. The vulnerability is network-exploitable with no authentication or user interaction required, and a public proof-of-concept is documented on GitHub. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.33% suggests limited observed exploitation activity despite the POC's existence.
A security vulnerability has been detected in DCMTK up to 3.6.5. Rated low severity (CVSS 1.9), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in bftpd up to version 6.2 within the expand_groups function of the configuration file handler allows local authenticated attackers to cause limited memory corruption with high attack complexity. Public exploit code is available, though the vulnerability requires local access and elevated privileges (PR:L), significantly limiting real-world exploitation potential compared to its CVSS score. The vendor did not respond to early disclosure.
Stack-based buffer overflow in Wincor Nixdorf PORT IO Driver versions up to 1.0.0.1 allows local authenticated attackers with low privileges to achieve arbitrary code execution with kernel-level permissions. The vulnerability exists in the sub_11100 function of the wnport.sys kernel driver's IOCTL handler. Public exploit code is available (CVSS E:P). Vendor has released version 3.0.0.1 to address this issue. EPSS data not available, not listed in CISA KEV, suggesting targeted rather than widespread exploitation despite public POC.
Out-of-bounds read in GNU Binutils 2.45 linker (ld) allows local authenticated attackers to read adjacent memory via manipulation of the vfinfo function in ldmisc.c, potentially disclosing sensitive information. Public exploit code is available, though the EPSS score of 0.03% indicates minimal real-world exploitation probability. The CVSS severity of 1.9 reflects limited impact (availability only) and requirement for local authenticated access.
Memory disclosure and denial of service in the Linux kernel's SCSI target (LIO) subsystem arises when reading the configfs attribute exposed by target_lu_gp_members_show() in drivers/target/target_core_configfs.c. Because snprintf() returns the length it *would* have written, a combined HBA name plus device name exceeding the 256-byte LU_GROUP_NAME_BUF buffer causes the subsequent memcpy() to copy past the buffer, tripping the kernel's overflow detection and potentially leaking adjacent memory or crashing the host. This is no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile) and no CISA KEV listing.
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.
Out-of-bounds memory access in the Linux kernel's in-kernel SMB/CIFS client (smb2_compound_op() in fs/smb/client) stems from wrong index references when iterating over compound SMB2 response buffers; a computed index at or above MAX_COMPOUND drives reads/writes past the response array. A machine mounting a share from a malicious or compromised SMB server can have its kernel process attacker-influenced compound responses, leading to memory corruption, denial of service, or potential privilege escalation. It carries a CNA-assigned CVSS 9.8, but there is no public exploit identified at time of analysis and EPSS is very low (0.19%, 8th percentile), so real-world exploitation pressure is currently minimal.
Local privilege escalation and memory corruption in the Linux kernel's fbcon (framebuffer console) subsystem stems from integer overflows in fbcon_do_set_font() when computing font buffer sizes from user-controlled parameters. A local, low-privileged attacker who can invoke the font-setting ioctl can trigger undersized allocations followed by heap buffer overflows during font data copying, potentially achieving code execution in kernel context. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the fix has been merged and backported across stable kernel trees.
Authenticated remote code execution in Fortinet FortiOS, FortiProxy, and FortiPAM enables low-privileged users to trigger a heap-based buffer overflow through crafted RDP bookmark connection requests. The flaw affects multiple major release trains across all three product families, including FortiOS 7.6.2 and earlier, 7.4.7 and earlier, 7.2.10 and earlier, and all 6.4/7.0 versions. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Memory buffer bounds violation in AMI Aptio V UEFI BIOS firmware allows a local low-privileged attacker to corrupt firmware memory, compromising system integrity and availability at the firmware layer. The flaw (CWE-119) operates below the operating system, meaning successful exploitation can subvert protections that survive OS reinstallation and bypass standard security tooling. No public exploit code has been identified and EPSS is 0.05%, indicating no observed exploitation activity at time of analysis.
Out-of-bounds write in AMI Aptio V BIOS allows local low-privilege authenticated attackers to corrupt memory, leading to data loss and system unavailability. The vulnerability is rated medium (CVSS 4.0: 5.9) and has a very low EPSS score (0.05%), indicating minimal immediate exploitation risk, with a vendor advisory already released.
Local authenticated
Remote code execution in Mozilla Firefox 143 and Thunderbird 143 allows unauthenticated network attackers to execute arbitrary code via memory corruption. The vulnerability stems from a memory safety bug (CWE-119 buffer overflow) exploitable without user interaction. CVSS score of 9.8 reflects critical severity with network-based attack vector, low complexity, and no privileges required. Vendor-released patches are available in Firefox 144 and Thunderbird 144. No public exploit identified at time of analysis, though Mozilla's assessment indicates the memory corruption is presumed exploitable with sufficient effort.
Use-after-free memory corruption in Mozilla Thunderbird 143+ and Firefox allows remote code execution via malicious web extensions exploiting the native messaging API on Windows. CVSS 9.8 (critical) with network-based attack vector requiring no user interaction or authentication. Patched in Firefox 144 and Thunderbird 144. No public exploit identified at time of analysis, but CVSS metrics indicate high exploitability (AV:N/AC:L/PR:N/UI:N) with complete impact to confidentiality, integrity, and availability.
Memory corruption in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird ESR 140.3 enables remote arbitrary code execution when users interact with malicious content. Exploitation requires user interaction (opening crafted web content or email), but no authentication is needed. Mozilla issued patches in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird ESR 140.4. With CVSS 8.8 and EPSS data unavailable, the vulnerability represents critical risk to unpatched installations. No public exploit identified at time of analysis, though Mozilla's acknowledgment of memory corruption evidence suggests exploitation is technically feasible.
Memory corruption vulnerabilities in Mozilla Firefox and Thunderbird allow remote code execution when users interact with malicious web content. Affects Firefox ESR 115.28 and below, Firefox ESR 140.3 and below, Firefox 143 and below, Thunderbird 143 and below, and Thunderbird ESR 140.3 and below. Mozilla confirmed memory safety bugs with evidence of memory corruption presumed exploitable for arbitrary code execution. Vendor-released patches available: Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. CVSS 8.8 severity driven by network attack vector with low complexity requiring only user interaction, no authentication required. No public exploit identified at time of analysis, though multiple internal bug reports suggest coordinated fix effort.
Out-of-bounds memory corruption in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to achieve code execution via malicious WebGL texture operations. A compromised web content process can exploit manipulated WebGL textures to trigger out-of-bounds reads and writes in privileged browser processes, potentially leading to full system compromise. Affects Firefox <144, Firefox ESR <115.29 and <140.4, and Thunderbird <144 and <140.4. Vendor-released patches available across all affected product lines. CVSS 9.8 reflects network-accessible, no-authentication-required attack with high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the specific Bugzilla reference (1989127) indicates detailed technical analysis exists.
Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Modem, there is a possible out of bounds write due to a heap buffer overflow. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Modem, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In ims service, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while accessing a buffer during IOCTL processing. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing large input data from a remote source via a communication interface. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while processing message from client with invalid payload. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption when triggering a subsystem crash with an out-of-range identifier. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing client message during device management. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing request sent from GVM. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing audio streaming operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while processing a GP command response. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Memory corruption while performing encryption and decryption commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure while registering commands from clients with diag through diagHal. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A buffer overflow was addressed with improved bounds checking. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved input validation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A buffer overflow was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer overflow vulnerability (CWE-119) in Apple's HID (Human Interface Device) subsystem affecting macOS Tahoe, iOS, and iPadOS that allows a malicious or compromised HID device to trigger an unexpected process crash, resulting in denial of service. The vulnerability requires adjacent network access and no user interaction, but does not compromise confidentiality or integrity. Apple has patched this issue in version 26.1 across affected platforms.
Multiple issues were addressed by disabling array allocation sinking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds access issue was addressed with improved bounds checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write issue was addressed with improved input validation. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved bounds checking. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds read was addressed with improved bounds checking. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was determined in Tenda AC10 16.03.10.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Tenda A15 15.13.07.13. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Tenda AC8 16.03.34.06. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was identified in Tenda AC21 16.03.08.16. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Tenda AC23 16.03.07.52. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
/etc/timezone can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
/etc/avahi/services/z9.service can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Stack-based buffer overflow in QEMU's e1000 network device emulation allows local guest users to crash the QEMU process via crafted short frames in loopback mode, causing denial of service on the host. The vulnerability exists in the e1000_receive_iov() function where frame padding logic was removed from the device layer but loopback mode still processes short frames unsafely. No public exploit code or active exploitation in KEV has been reported at time of analysis.
Denial of service in the Tenda AC8 dual-band gigabit router (hardware revision v03.03.10.01) allows a remote attacker to crash the device by sending a single crafted packet to its UPnP service, triggering a stack-based buffer overflow (CWE-121). The flaw requires no authentication or user interaction per the CVSS vector (PR:N/UI:N) and impacts availability only (A:H, no confidentiality/integrity impact). Publicly available exploit material exists via a researcher GitHub repository, though the issue is not listed in CISA KEV and carries a modest EPSS score of 0.39% (31st percentile).
Out-of-bounds memory read in the Linux kernel's hfsplus filesystem driver (fixed in 6.17-rc series) allows a local user to leak adjacent slab memory and crash the system when the kernel parses a maliciously crafted HFS+ volume. The flaw lives in hfsplus_strcasecmp() during B-tree catalog record comparison and is reached through ordinary path lookup on a mounted HFS+ image. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with a local, filesystem-parsing memory-safety bug rather than a remotely weaponizable one.
Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.
Use-after-free in X.Org X server and Xwayland during Present extension notification processing allows local authenticated users to achieve arbitrary code execution or denial of service. The flaw affects core display server components across multiple Linux distributions, with Red Hat confirming patches through 15 security advisories (RHSA-2025:19432 through RHSA-2025:22055). CVSS 7.3 reflects high integrity and availability impact with low confidentiality impact. No active exploitation confirmed (not in CISA KEV). EPSS data not provided, but the local attack vector and authentication requirement reduce remote exploitation risk despite the severity of potential impact.
Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).
Out-of-bounds slab read in the Linux kernel's HFS+ filesystem driver (fs/hfsplus/unicode.c) allows a local low-privileged attacker to read adjacent kernel heap memory by triggering hfsplus_uni2asc() through the listxattr() path on a crafted/malformed HFS+ image. Because hfsplus_listxattr() passes a struct hfsplus_attr_unistr* whose layout differs from the struct hfsplus_unistr* the earlier fix (commit 94458781aee6) assumed, an oversized ustrlen drives the Unicode buffer pointer past the allocation. There is no public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a memory-disclosure primitive requiring local filesystem access rather than remote mass exploitation.
Local privilege escalation potential in the Linux kernel's ARM Statistical Profiling Extension (arm_spe) perf driver stems from an integer overflow in the PERF_IDX2OFF() calculation when an AUX ring buffer of 2 GiB or larger is used. On affected arm64 systems, a local user with permission to open SPE perf events can trigger the overflow because nr_pages was not cast to unsigned long, producing an incorrect buffer offset and out-of-bounds kernel memory access. This is a resolved kernel bug fixed via stable-tree commits; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%, 10th percentile).
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Out-of-bounds/use-after-free read in the Linux kernel UDF (Universal Disk Format) filesystem driver allows a local attacker to crash the kernel or leak adjacent memory by getting a crafted or corrupted UDF image mounted and accessed. The flaw lies in fs/udf handling of the on-disk lengthAllocDescs field, which was not validated against the block size, causing udf_update_tag() to invoke crc_itu_t() on memory past the buffer. It was found by the Linux Verification Center via Syzkaller; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Use-after-free vulnerability in Kamailio 5.5.0 configuration file parser allows local authenticated attackers to cause denial of service or memory corruption via malformed configuration files. The vulnerability exists in the sr_push_yy_state function within the lexical analyzer (cfg.lex) and has publicly available exploit code, though the vendor has not responded to disclosure and practical exploitability remains uncertain due to the requirement for direct configuration file manipulation.
Heap-based buffer overflow in Kamailio 5.5.0's rve_destroy function allows local authenticated attackers to cause limited data corruption through manipulation of configuration files, with publicly available exploit code but extremely low real-world risk due to local access requirement, authenticated privilege level, and acknowledged uncertainty about vulnerability existence.
Arbitrary file read in PerfreeBlog v4.0.11 allows unauthenticated remote attackers to read files outside the intended web root by bypassing path validation in the validThemeFilePath function. The vulnerability is network-exploitable with no authentication or user interaction required, and a public proof-of-concept is documented on GitHub. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.33% suggests limited observed exploitation activity despite the POC's existence.
A security vulnerability has been detected in DCMTK up to 3.6.5. Rated low severity (CVSS 1.9), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in bftpd up to version 6.2 within the expand_groups function of the configuration file handler allows local authenticated attackers to cause limited memory corruption with high attack complexity. Public exploit code is available, though the vulnerability requires local access and elevated privileges (PR:L), significantly limiting real-world exploitation potential compared to its CVSS score. The vendor did not respond to early disclosure.
Stack-based buffer overflow in Wincor Nixdorf PORT IO Driver versions up to 1.0.0.1 allows local authenticated attackers with low privileges to achieve arbitrary code execution with kernel-level permissions. The vulnerability exists in the sub_11100 function of the wnport.sys kernel driver's IOCTL handler. Public exploit code is available (CVSS E:P). Vendor has released version 3.0.0.1 to address this issue. EPSS data not available, not listed in CISA KEV, suggesting targeted rather than widespread exploitation despite public POC.
Out-of-bounds read in GNU Binutils 2.45 linker (ld) allows local authenticated attackers to read adjacent memory via manipulation of the vfinfo function in ldmisc.c, potentially disclosing sensitive information. Public exploit code is available, though the EPSS score of 0.03% indicates minimal real-world exploitation probability. The CVSS severity of 1.9 reflects limited impact (availability only) and requirement for local authenticated access.
Memory disclosure and denial of service in the Linux kernel's SCSI target (LIO) subsystem arises when reading the configfs attribute exposed by target_lu_gp_members_show() in drivers/target/target_core_configfs.c. Because snprintf() returns the length it *would* have written, a combined HBA name plus device name exceeding the 256-byte LU_GROUP_NAME_BUF buffer causes the subsequent memcpy() to copy past the buffer, tripping the kernel's overflow detection and potentially leaking adjacent memory or crashing the host. This is no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile) and no CISA KEV listing.
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.
Out-of-bounds memory access in the Linux kernel's in-kernel SMB/CIFS client (smb2_compound_op() in fs/smb/client) stems from wrong index references when iterating over compound SMB2 response buffers; a computed index at or above MAX_COMPOUND drives reads/writes past the response array. A machine mounting a share from a malicious or compromised SMB server can have its kernel process attacker-influenced compound responses, leading to memory corruption, denial of service, or potential privilege escalation. It carries a CNA-assigned CVSS 9.8, but there is no public exploit identified at time of analysis and EPSS is very low (0.19%, 8th percentile), so real-world exploitation pressure is currently minimal.
Local privilege escalation and memory corruption in the Linux kernel's fbcon (framebuffer console) subsystem stems from integer overflows in fbcon_do_set_font() when computing font buffer sizes from user-controlled parameters. A local, low-privileged attacker who can invoke the font-setting ioctl can trigger undersized allocations followed by heap buffer overflows during font data copying, potentially achieving code execution in kernel context. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the fix has been merged and backported across stable kernel trees.
Authenticated remote code execution in Fortinet FortiOS, FortiProxy, and FortiPAM enables low-privileged users to trigger a heap-based buffer overflow through crafted RDP bookmark connection requests. The flaw affects multiple major release trains across all three product families, including FortiOS 7.6.2 and earlier, 7.4.7 and earlier, 7.2.10 and earlier, and all 6.4/7.0 versions. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Memory buffer bounds violation in AMI Aptio V UEFI BIOS firmware allows a local low-privileged attacker to corrupt firmware memory, compromising system integrity and availability at the firmware layer. The flaw (CWE-119) operates below the operating system, meaning successful exploitation can subvert protections that survive OS reinstallation and bypass standard security tooling. No public exploit code has been identified and EPSS is 0.05%, indicating no observed exploitation activity at time of analysis.
Out-of-bounds write in AMI Aptio V BIOS allows local low-privilege authenticated attackers to corrupt memory, leading to data loss and system unavailability. The vulnerability is rated medium (CVSS 4.0: 5.9) and has a very low EPSS score (0.05%), indicating minimal immediate exploitation risk, with a vendor advisory already released.
Local authenticated
Remote code execution in Mozilla Firefox 143 and Thunderbird 143 allows unauthenticated network attackers to execute arbitrary code via memory corruption. The vulnerability stems from a memory safety bug (CWE-119 buffer overflow) exploitable without user interaction. CVSS score of 9.8 reflects critical severity with network-based attack vector, low complexity, and no privileges required. Vendor-released patches are available in Firefox 144 and Thunderbird 144. No public exploit identified at time of analysis, though Mozilla's assessment indicates the memory corruption is presumed exploitable with sufficient effort.
Use-after-free memory corruption in Mozilla Thunderbird 143+ and Firefox allows remote code execution via malicious web extensions exploiting the native messaging API on Windows. CVSS 9.8 (critical) with network-based attack vector requiring no user interaction or authentication. Patched in Firefox 144 and Thunderbird 144. No public exploit identified at time of analysis, but CVSS metrics indicate high exploitability (AV:N/AC:L/PR:N/UI:N) with complete impact to confidentiality, integrity, and availability.
Memory corruption in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird ESR 140.3 enables remote arbitrary code execution when users interact with malicious content. Exploitation requires user interaction (opening crafted web content or email), but no authentication is needed. Mozilla issued patches in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird ESR 140.4. With CVSS 8.8 and EPSS data unavailable, the vulnerability represents critical risk to unpatched installations. No public exploit identified at time of analysis, though Mozilla's acknowledgment of memory corruption evidence suggests exploitation is technically feasible.
Memory corruption vulnerabilities in Mozilla Firefox and Thunderbird allow remote code execution when users interact with malicious web content. Affects Firefox ESR 115.28 and below, Firefox ESR 140.3 and below, Firefox 143 and below, Thunderbird 143 and below, and Thunderbird ESR 140.3 and below. Mozilla confirmed memory safety bugs with evidence of memory corruption presumed exploitable for arbitrary code execution. Vendor-released patches available: Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. CVSS 8.8 severity driven by network attack vector with low complexity requiring only user interaction, no authentication required. No public exploit identified at time of analysis, though multiple internal bug reports suggest coordinated fix effort.
Out-of-bounds memory corruption in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to achieve code execution via malicious WebGL texture operations. A compromised web content process can exploit manipulated WebGL textures to trigger out-of-bounds reads and writes in privileged browser processes, potentially leading to full system compromise. Affects Firefox <144, Firefox ESR <115.29 and <140.4, and Thunderbird <144 and <140.4. Vendor-released patches available across all affected product lines. CVSS 9.8 reflects network-accessible, no-authentication-required attack with high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the specific Bugzilla reference (1989127) indicates detailed technical analysis exists.
Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).