Denial Of Service
Monthly
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 81.2%.
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 78.9%.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Internet Explorer 8 through 10 contain a memory corruption vulnerability allowing remote code execution via crafted websites, used in targeted attacks against defense and aerospace organizations in 2013.
Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 67.2%.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 72.1%.
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 81.3%.
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.5%.
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not properly handle exceptions, which allows local users to gain privileges or. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available.
Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 51.7%.
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.exe 65.50.2011.18049 in KingView 6.55 allows remote. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 58.3%.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 86.1%.
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 84.4%.
Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 78.1%.
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 79.1%.
An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 67.9%.
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft XML Core Services 3.0 through 6.0 access uninitialized memory locations, allowing remote attackers to execute code or cause memory corruption through a crafted website, actively exploited before patch availability.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 69.6%.
Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 83.6%.
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.7%.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Denial of service in Grafana (fixed in Alpine Linux package grafana 12.4.4-r0) allows remote unauthenticated attackers to exhaust server resources and render the observability dashboard unavailable. The flaw is classified as uncontrolled resource consumption (CWE-400) with a network-reachable, no-privilege, no-interaction attack profile (CVSS 7.5, availability-only). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Grafana prior to 12.4.4-r0 allows remote unauthenticated attackers to disrupt service availability over the network with low complexity. Alpine Linux has shipped the fixed package version, and no public exploit identified at time of analysis. Despite tagging suggesting information disclosure, the CVSS vector indicates an availability-only impact, which warrants clarification from the vendor advisory.
Denial of service in Grafana OSS (multiple 11.6.x, 12.2.x, 12.3.x, 12.4.x and 13.0.x branches) lets remote attackers exhaust server resources and crash or hang the analytics dashboard, per an Alpine Linux advisory that ships the fix in package build 12.4.4-r0. The flaw is an uncontrolled-resource-consumption (CWE-400) condition scored CVSS 7.5 with availability-only impact; no confidentiality or integrity loss occurs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.36%, 28th percentile).
Denial of service in Samba on Alpine Linux causes the smbd service to crash via a NULL pointer dereference triggered by remote unauthenticated network requests. Alpine Linux has issued a fix in samba 4.23.8-r0, and no public exploit identified at time of analysis. The CVSS 7.5 score reflects high availability impact with a network attack vector requiring no privileges or user interaction.
Denial of service in the ack code-search tool (App::Ack / ack3) before v3.10.0 allows a project-scoped .ackrc file to trigger memory exhaustion by setting an unbounded -A/-B/-C context value. When a victim runs ack inside a directory containing an attacker-supplied .ackrc, the oversized context request forces unbounded buffering and can exhaust process/host memory. No public exploit identified at time of analysis; not listed in CISA KEV.
Unbounded memory growth in the Protocol::HTTP2 Perl library (versions prior to 1.14) allows a remote unauthenticated attacker to exhaust server memory by cycling large numbers of HTTP/2 streams. The library's stream-state tracker accumulated closed-stream records indefinitely with no eviction, enabling a slow-burn denial-of-service attack against any application embedding this module as its HTTP/2 implementation. Fixed in Protocol::HTTP2 1.14 (Alpine Linux perl-protocol-http2 1.14-r0); no public exploit code or active exploitation identified at time of analysis.
Denial of service in the Perl HTTP::Date module (libwww-perl's parse_date/str2time) before version 6.08 lets remote attackers exhaust CPU by submitting hostile Date-header-style strings that trigger quadratic regex backtracking (ReDoS). Any application that feeds untrusted date strings - HTTP clients, servers, and mail tooling built on libwww-perl - is affected; a ~40 KB crafted string can burn tens of seconds of CPU per request. No public exploit identified at time of analysis, though a regression test demonstrating the pathological input ships with the fix, and EPSS is low (0.21%).
Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.
Denial of service in the Suricata SMB parser lets remote attackers exhaust sensor CPU and memory by driving sustained one-directional SMB traffic through an affected sensor. Suricata versions prior to 7.0.17 and 8.0.6 retain force-completed transactions on flows where payload is seen in only one direction (including async-oneside flows), because cleanup waits for inspection in the direction that never arrives; transaction creation paths can then exceed the intended SMB_MAX_TX bound while cleanup repeatedly rescans the growing list, producing unbounded per-flow state. No public exploit identified at time of analysis, and exploitation is constrained (AC:H) to deployments that both enable SMB app-layer inspection and observe one-directional visibility such as async-oneside or asymmetric routing, making this a genuine but moderate-priority monitoring-plane risk rather than a compromise of confidentiality or integrity.
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application that parses an attacker-supplied SoundFont 2 file. The SF2 parser derives the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without first rejecting chunks smaller than a single record, so a zero-sized DMOD chunk underflows the unsigned subtraction to UINT_MAX and the loader attempts to allocate billions of SFMod structures until process memory is exhausted. Rated CVSS 6.2 (AV:L/AC:L/PR:N/UI:N, availability-only), the issue requires only that a crafted .sf2 file be loaded locally (no privileges and no user interaction beyond opening the file), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-released patch is version 2.5.6.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-size check, triggering an approximately 4 GB pool-cue allocation and billions of out-of-bounds reads that crash the process, producing a denial of service against the affected 2.5.0 through 2.5.5 releases. Exploitation requires the library to be built with enable-native-dls=ON and an attacker-supplied DLS file to be opened by the application; the CVSS vector indicates no privileges are required (PR:N), and no public exploit code was identified at time of analysis. The vendor has fixed the flaw in FluidSynth 2.5.6.
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted DLS SoundFont file: an integer overflow in the parser's articulation-chunk size check lets the loader run roughly a billion out-of-bounds 12-byte iterations, causing a crash or hang. The flaw affects versions 2.5.0 through 2.5.5 and is fixed in 2.5.6; exploitation requires the target to be built with the non-default CMake option enable-native-dls set to ON and to load the attacker-supplied file (unauthenticated per the CVSS PR:N vector, but the attack vector is local and the malicious file must reach the application). No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - there is no code execution or data disclosure.
Autobahn Python releases prior to 26.7.1 enforce the maxMessagePayloadSize receive limit against the compressed on-the-wire frame length rather than the inflated message size, so an unauthenticated remote client can send a small permessage-deflate frame that decompresses far past the configured application message cap and is nonetheless allocated, reassembled, validated, and handed to application callbacks. The impact is resource-exhaustion pressure scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, availability-only), and the advisory does not establish confidentiality or integrity impact despite the general 'Information Disclosure' tag; no public exploit identified at time of analysis. Exposure is limited to WebSocket endpoints that negotiate permessage-compress (permessage-deflate or the bzip2/snappy/brotli backends) - endpoints that do not accept a compression extension for the connecting client are unaffected.
Denial of service in IBM i 7.3, 7.4, 7.5, and 7.6 allows unauthenticated attackers on an adjacent network segment to disrupt the integrated FTP server by sending authentication commands that are not properly validated. Because the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, the credential-free USER/PASS handshake is the likely trigger path, but realistic exposure is confined to LAN or same-broadcast-segment reachability rather than arbitrary internet access, and there is no confidentiality exposure or code execution evidenced. IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
In osmo-iuh from 1.10.0 through 1.14.5 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
Denial of service in AnyIO versions prior to 4.14.2: the process-pool implementation behind to_process.run_sync() starts worker processes with stderr wired to a pipe that the parent never drains, so a worker that writes more than the roughly 64 KiB pipe buffer to sys.stderr blocks on write() before it can return its stdout protocol response, leaving the awaiting process-pool call hung indefinitely. Applications are exposed only if they actually use AnyIO's process pool and run worker functions whose stderr volume can be driven by untrusted or faulty input - for example verbose tracebacks or logging produced by attacker-influenced data - while code paths that never touch to_process, or that already close/redirect worker stderr, are unaffected. Impact is limited to availability (hang), with no confidentiality, integrity, or code-execution effect, and per the vendor and independent assessment this is a local, low-privilege-scoped flaw (CVSS:4.0 AV:L/PR:L and CVSS:3.1 AV:L/PR:L, A:H); no public exploit code exists and no active exploitation has been confirmed (no public exploit identified at time of analysis).
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop by a malicious or compromised MQTT broker that replies to a client UNSUBSCRIBE exchange with a malformed packet containing a zero-length topic followed by trailing data. The defect is CWE-835 in nni_mqtt_msg_decode_unsubscribe() (nng/src/supplemental/mqtt/mqtt_codec.c), where a failed read_uint16() during topic counting leaves buf.curpos unchanged while topic_count keeps incrementing, so the parse loop never terminates; when automatic reconnection is enabled the client re-enters the same state repeatedly, producing a sustained denial of service against the client itself. The independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - a low-impact, low-priority availability issue with an inverted threat model, since the victim is the client and the attacker must supply the hostile endpoint; no public exploit code was identified at time of analysis and the issue is not in CISA KEV. Vendor-released patch: 0.24.14.
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PUBLISH or SUBSCRIBE packets containing a large number of User Properties. Each property is inserted via property_append(), which re-walks the entire linked list, so a single packet with many properties forces quadratic (O(N²)) CPU work in the decoder; repeating the packet sustains the denial of service. The vendor has released a fix in 0.24.14, and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is availability-only and rated low, with the independent assessment noting that effectiveness depends on how many properties can be packed into a packet and on continued resending.
An integer-overflow flaw in libheif's RGB-to-YCbCr conversion path (libheif/color-conversion/rgb2yuv.cc) can crash an application that encodes extremely large RGB images constructed via heif_image_create() and heif_image_add_plane() before calling heif_context_encode_image(); a 32-bit stride field wraps, so the conversion loop computes an invalid input pointer and reads past the end of the allocated interleaved plane. Affected deployments are those running libheif versions prior to 1.19.6 that expose the ENCODE path to caller- or attacker-influenced image dimensions - pure decode/parsing workflows are not affected. Impact is limited to process termination (no code execution, no data disclosure), and no public exploit code was identified at time of analysis.
Denial of service in OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1 occurs when the library processes a truncated TGA file while writing GIF output, triggering a signed 32-bit integer overflow in GifSplitPalette() that leads to an out-of-bounds read (CWE-125) and a process crash. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates the attacker is unauthenticated (PR:N) but requires local access and user interaction, with no remote or unauthenticated network trigger. No public exploit code or active exploitation has been identified; this is a low-priority hardening issue for workflows that transcode untrusted images to GIF.
Denial of service in OpenImageIO prior to 3.1.16.0: processing a crafted ZIP/Deflate-compressed TIFF while TIFF multithreading is enabled can crash the image-reading process. The bug is an object destruction-order error in TIFFInput::read_native_scanlines(), where an error path returns before queued asynchronous strip-decompression tasks are joined, letting worker tasks touch stale stack and heap storage (use-after-scope). The assessed vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - no privileges required, but a user or pipeline must open the malicious file (UI:R) and the crash depends on a narrow timing window (AC:H); impact is availability only, with no memory disclosure or code execution, and no public exploit identified at time of analysis.
Authenticated users on the IBM TS4300 tape library management interface can degrade the appliance's email notification service by triggering requests faster than it can handle, due to missing interaction-frequency (rate) controls in firmware versions 1.1.0.1 through 1.7.1.1. The impact is confined to availability of the email/alerting subsystem (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); the data path, stored data, and integrity are unaffected, and valid credentials are a hard prerequisite. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a low-priority, patch-available hardening issue.
Denial of service in OpenImageIO's PSD reader allows a crafted PSD file carrying an invalid color_mode value to index beyond the fixed color-mode tables, producing a global out-of-bounds read and potentially a bogus allocation that crashes the reading process. The exposure is narrow: the raw path is only reachable when the non-default oiio:RawColor or psd:RawData option is explicitly enabled, and an attacker must get a target application or automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5, CWE-125), so impact is availability-only with no confidentiality or integrity effect. No public exploit has been identified at time of analysis, and vendor-released fixes exist in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Stack-based buffer overflow in OpenImageIO's Cineon image reader (CineonInput::open()) lets a crafted .cin file that declares more than the format's maximum of eight channels overwrite stack pointers and corrupt adjacent memory, crashing the application that processes it. Exploitation requires the victim or an automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, 6.1), so it cannot be triggered remotely without inducing file ingestion; the assessed impact is denial of service with only low integrity risk and no confidentiality loss. No public exploit identified at time of analysis and the issue is not in CISA KEV; vendor fixes shipped in OpenImageIO 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
Stack exhaustion in OpenImageIO's FITS image reader (all releases prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1) lets a crafted FITS stream crash a parsing process by driving FitsInput::read_fits_header() into unbounded recursion. The trigger is a stream of consecutive 2880-byte header blocks that never contain the mandatory END keyword, so each block causes another self-call until the application stack is consumed; remote, unauthenticated attackers can deliver the payload but successful exploitation requires the victim to open or ingest the file (UI:R), and the resulting impact is availability-only with no code execution or data disclosure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released fixes are available.
Denial of service in WinFsp through 2.2.26215 allows an authenticated, unprivileged local user to crash the Windows kernel by issuing FSP_IOCTL_TRANSACT requests to the WinFsp control device, triggering a null pointer dereference in the driver's Fast I/O device control handler. The vulnerability requires local access (PR:L) and a system with WinFsp installed; it results only in a system crash with no data exposure or code execution. No public exploit code has been identified at time of analysis, and the flaw is not known to be actively exploited.
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. This availability-only issue affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and Red Hat Hardened Images, and exploitation requires a victim to open a malicious PDF (UI:R, AV:L, PR:N - no privileges required). No public exploit identified at time of analysis, and no confirmed active exploitation.
Memory-exhaustion denial of service in ImageMagick before 7.1.2-31 stems from the Ultra HDR (UHDR) encoder omitting resource-policy checks while allocating the pixel buffer, so a crafted UHDR image can push allocations past the memory/area/disk limits an operator configured in policy.xml. The flaw is remotely reachable without authentication (CVSS 4.0 vector PR:N/UI:N) in any application that routes untrusted images through ImageMagick's UHDR encoding path, but the independent assessment rates it low priority: AC:H and AT:P reflect a niche code path and a crafted image that must reliably defeat the policy logic, and impact is confined to availability (VC:N/VI:N/VA:L) with no confidentiality, integrity, or code-execution effect. Vendor patch 7.1.2-31 is available; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A division-by-zero in ImageMagick's FLIF encoder allows unauthenticated remote attackers to crash the encoder process by supplying an image whose ticks-per-second field yields a zero divisor, causing a denial of service. Affected versions are ImageMagick before 7.1.2-31 (7.x) and before 6.9.13-56 (6.x); exploitation requires that a target application encode attacker-influenced data to FLIF, a relatively uncommon output format, and no public exploit code or active exploitation has been identified at time of analysis.
ImageMagick's PNM (Netpbm) image coder can be crashed via a NULL pointer dereference when processing a specially crafted or sufficiently large PNM image that pushes the library to its configured memory/resource limit at a specific allocation point where the failed allocation is never checked. The flaw affects ImageMagick releases before 7.1.2-31 on the 7.x branch and before 6.9.13-56 on the legacy 6.x branch, and the outcome is limited to a denial of service - a single-process crash that can be restarted - with no data exposure, integrity loss, or code execution. Severity is low (vendor CVSS 4.0 base 2.3; independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L with high attack complexity and partial prerequisite conditions), no public exploit code was identified at time of analysis, and a vendor-released patch is available.
Memory resource limits configured for ImageMagick are not enforced by the PCD coder (and, per the upstream advisory, the CUBE and HALD coders) when a specific command-line option is supplied, so a local user who can control ImageMagick invocation arguments can push the process past its intended policy limit and cause additional memory allocation. Impact is confined to limited availability degradation - no code execution, no data exposure, no integrity change - and the path is local-only with low privileges required (AV:L/PR:L in the assessed vector). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is rated low priority; vendor fixes 7.1.2-31 (7.x) and 6.9.13-56 (6.x) are available, and environments that invoke ImageMagick with fixed, non-user-controlled arguments are not exposed.
Memory corruption in ImageMagick's ImagesToBlob blob-conversion routine can crash an affected process on 7.x releases before 7.1.2-31 and 6.x releases before 6.9.13-56. The flaw is a use-after-free (CWE-416) in which a pointer is not updated correctly, and exploitation requires a crafted image to reach a local ImageMagick process or library call (CVSS 4.0 AV:L/AC:H/AT:P, PR:N), so no authentication is required but the attack surface is local and the trigger is difficult to satisfy reliably. Impact is confined to availability (VC:N/VI:N/VA:L) with no evidence of code execution or data exposure, and no public exploit identified at time of analysis; vendor patches are available.
Denial of service in Netty's HTTP/2 HPACK encoder (HpackEncoder) allows an unauthenticated remote attacker to force excessive CPU and memory consumption by sending SETTINGS frames that advertise an oversized MAX_HEADER_TABLE_SIZE, causing the encoder to retain an excessive number of unique header entries. The issue affects applications and Red Hat products that embed Netty and expose an HTTP/2 listener - including JBoss EAP 7 and 8, Keycloak, Red Hat Single Sign-On 7, AMQ Broker 7, Data Grid 8, Fuse 7, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Apicurio Registry 3, and Debezium 3 - while HTTP/1.1-only endpoints are not exposed. Impact is bounded to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CVSS 5.3) with no data disclosure or modification; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Unauthenticated remote attackers can inflate a plugin option in the Really Simple Security WordPress plugin (versions 8.1.6 up to but not including 9.8.3) by supplying arbitrary address values that the plugin uses as storage keys without validation, causing unbounded option growth and slower handling of missing pages. The impact is availability-only degradation (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity effect, and default configurations are reachable by network unauthenticated exploitation as long as the site is online. Publicly available exploit code exists and WPScan published the finding, but there is no indication of confirmed active exploitation (CISA KEV); sites running 9.8.3 or later are unaffected.
Null pointer dereference in Freedesktop Poppler 26.07.0 within JBIG2Stream::rewind lets an unauthenticated remote attacker deliver a crafted PDF containing a malformed JBIG2 stream that crashes applications using Poppler for parsing, resulting in a low-severity denial of service. The victim must open or render the document (UI:P), and there is no server-side auto-trigger unless a backend automatically renders untrusted PDFs; impact is limited to a process crash, with no code execution or information disclosure. Publicly available exploit code exists, and the vendor has released Poppler 26.08.0 with patch commit 5e49250f13b0390edeb3f90eb4c02c9941f97067 to address the issue.
Resource exhaustion in the VES Collector component of O-RAN-SC SMO OAM 2025-06-10 allows an authenticated remote attacker to cause a limited denial of service by submitting manipulated input that drives uncontrolled resource allocation. Publicly available exploit code exists, but the issue is low priority per CVSS 2.1 and the independent assessment, with impact limited to availability of the collector and no confidentiality or integrity effect. The project has been notified via a bug report and has not responded, so no vendor patch is confirmed.
Uncontrolled resource allocation in the VES Collector component of the O-RAN-SC SMO OAM stack (2025-06-10 snapshot) lets an authenticated, low-privilege remote user exhaust collector resources and degrade availability of the OAM event-streaming service. The impact is availability-only and partial (CVSS 4.0 score 2.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L), with no confidentiality or integrity effect. Publicly available exploit code exists and was published alongside an upstream bug report (Jira SMO-202) that the project has not responded to, so no vendor patch or fixed version is available; the issue is not reported as confirmed actively exploited (CISA KEV), and overall risk is low.
Uncontrolled resource allocation in the VES Collector component of O-RAN-SC SMO OAM (2025-06-10) lets remote, unauthenticated attackers exhaust resources and degrade availability, with no confidentiality or integrity impact (VC:N/VI:N/VA:L). The CVSS 4.0 base of 6.9 reflects network reachability with no privileges or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N) and a proof-of-concept exploit is publicly available via a GitHub gist, though there is no confirmed actively exploited (CISA KEV) status. The upstream project was notified through a bug report (LF-O-RAN-SC Jira SMO-204) but has not responded, so no vendor-released patch is identified at time of analysis; practical exposure is limited to deployments where the VES Collector is reachable on an internal telecom OAM/management plane.
Uncontrolled memory allocation in the VES Collector component of O-RAN-SC SMO OAM 2025-06-10 allows a low-privilege, authenticated remote user to drive excessive memory consumption by manipulating the additionalFields.padding argument in a submitted VES event, degrading collector availability. Publicly available exploit code exists and the issue was reported upstream (SMO-201) without a vendor response, so no patched release is confirmed. Impact is limited to availability (VA:L) with no confidentiality or integrity effect, and the overall severity is low per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
An out-of-bounds read in OpenImageIO's BMP reader allows a crafted palette BMP to crash any process that decodes it, causing denial of service. Affected are versions prior to 3.0.16.0 and 3.1.11.0: a malformed file whose DIB header sets the palette flag but supplies an empty color table, combined with RLE4 or RLE8 compression, drives BmpInput::read_native_scanline into an invalid palette lookup. Exploitation requires the victim to process the attacker-supplied image (for example via oiiotool or an application linked against OpenImageIO), making the realistic risk concentrated in automated or batch image-ingestion pipelines; no public exploit identified at time of analysis, and CISA KEV does not list this issue.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
Denial of service in rabbitmq-c (librabbitmq) versions prior to 0.16.0 lets an attacker-controlled or on-path AMQP server crash a connecting client during the login handshake by sending an undersized HEADER or METHOD frame. The malformed frame triggers an unsigned size_t underflow in the frame parser that defeats downstream bounds checks and causes an out-of-bounds read, terminating the client process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) the impact is purely availability, requiring the victim to initiate a connection (UI:R); no public exploit identified at time of analysis, and TLS with proper certificate validation neutralizes the on-path variant.
Denial of service in the GNU C Library (glibc) DNS stub resolver causes any process that resolves names to abort via an assertion failure when the search list loaded from /etc/resolv.conf or the LOCALDOMAIN environment variable contains a single domain of roughly 200 characters or more; affected versions are 2.26 through 2.44. The weakness is reachable by an unauthenticated attacker on the adjacent network (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.3) only where search domains are populated from attacker-influenced DHCP or VPN configuration and the network-configuration software does not reject the over-length value; local exploitation requires the ability to write /etc/resolv.conf or set LOCALDOMAIN. Impact is limited to process termination (no code execution, data disclosure, or integrity impact), and no public exploit code was identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in update_tg_cfs_runnable() A divide-by-zero crash is observed when running hackbench: [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ [14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f/0x3e0 [14697.506799] <TASK> [14697.507411] __dequeue_task+0x2b4/0xc70 [14697.508677] dequeue_task_fair+0x36/0x370 [14697.509047] dequeue_task+0x101/0x2f0 [14697.509426] __schedule+0x1b1/0x1a00 [14697.510868] anon_pipe_read+0x3da/0x450 [14697.511400] vfs_read+0x361/0x390 [14697.512053] __x64_sys_read+0x19/0x30 The divide-by-zero happens here: if (scale_load_down(gcfs_rq->load.weight)) { load_sum = div_u64(gcfs_rq->avg.load_sum, scale_load_down(gcfs_rq->load.weight)); } gcfs_rq->load.weight is an insane large value and is truncated to the lower 32 bits by div_u64, which happen to be 0. Using AI for investigation, the cause is a u32 overflow in update_tg_cfs_runnable(), and flat pickup became a victim when using tg_tasks(): u32 new_sum, divider; ... new_sum = se->avg.runnable_avg * divider; <-- boom The following sequence shows how this triggers the crash: propagate_entity_load_avg() update_tg_cfs_runnable() # u32 overflow corrupts runnable_sum __update_load_avg_cfs_rq() ___update_load_avg() # computes insane runnable_avg update_tg_load_avg() # propagates to tg->runnable_avg update_cfs_group() calc_concur_shares() tg_tasks() # long-to-int truncation, negative nr reweight_entity() # corrupted se->load.weight update_load_add() # corrupted cfs_rq->load.weight propagate_entity_load_avg() update_tg_cfs_load() div_u64() # divide-by-zero Fix by widening new_sum from u32 to u64 (no need to force tg_tasks() to return unsigned long after this fix)
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix NPD issue on partial unmap of an evicted BO This commit fixes the NULL pointer dereference issue that would have happened on the split of GPU mapping due to partial unmap of an evicted BO. There is a logic to handle the partial unmap of huge pages when the GPU mapping is split. That logic was not being completely skipped for the VMA of an evicted BO and that resulted in a NPD possibility for the 'bo->backing.pages' pointer, which is set to NULL when pages of a BO are released on eviction. Following dump was seen when a partial unmap was exercised for an evicted BO. Unable to handle kernel paging request at virtual address 0000000000002000 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008842e8000 [0000000000002000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP <snip> pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : iova_mapped_as_huge_page+0x20/0x68 [panthor] lr : panthor_gpuva_sm_step_remap+0x39c/0x498 [panthor] sp : ffff800086193920 x29: ffff800086193920 x28: ffff800086193a18 x27: ffff800086193b80 x26: 0000000000400000 x25: 0000000000810000 x24: 0000000000400000 x23: ffff000808af1800 x22: 0000000000a00000 x21: ffff800086193a00 x20: ffff000806fd3f00 x19: 0000000000410000 x18: 00000000ffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff800083ce2d83 x14: 0000000000000000 x13: 3120646574636976 x12: 6520303030303138 x11: 2d30303030313420 x10: ffff8000836e6c80 x9 : ffff80007bfc889c x8 : 3fffffffffffefff x7 : ffff8000836e6c80 x6 : 0000000000000000 x5 : ffff00097ef19088 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000010000 x1 : 0000000000000400 x0 : 0000000000000000 Call trace: iova_mapped_as_huge_page+0x20/0x68 [panthor] (P) op_remap_cb.isra.0+0x70/0xb0 __drm_gpuvm_sm_unmap+0xf8/0x1c0 drm_gpuvm_sm_unmap+0x40/0x60 panthor_vm_exec_op+0xa0/0x168 [panthor] panthor_vm_bind_exec_sync_op+0x8c/0xb8 [panthor] panthor_ioctl_vm_bind+0xbc/0x170 [panthor] drm_ioctl_kernel+0xc0/0x140 drm_ioctl+0x20c/0x500 __arm64_sys_ioctl+0xb4/0x118 invoke_syscall+0x5c/0x120 el0_svc_common.constprop.0+0x48/0xf8 do_el0_svc+0x28/0x40 el0_svc+0x38/0x128 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x198/0x1a0 Code: 8b030021 cb020021 f940b800 d34cfc21 (f8617801) ---[ end trace 0000000000000000 ]--- v2: Fix indentation
In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC The loop iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed by XCC ID >= 2. Extend the loop to cover all XCCs (AMDGPU_MAX_MES_PIPES * num_xcc), matching other per-XCC arrays.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device ACPI companion object need to verify its presence. asus_wireless_probe() returns success when acpi_match_acpi_device() finds no match, leaving behind an input device that never reports anything because the notify handler is not installed. Worse, when the driver is force-bound to a device without an ACPI companion, probe still succeeds and stores a NULL companion pointer, which asus_wireless_remove() later passes to acpi_dev_remove_notify_handler(), leading to a NULL pointer dereference on unbind. Return -ENODEV when the device does not match the ID table. This also covers the missing-companion case, because acpi_match_acpi_device() rejects a NULL device. Perform the check before allocating any driver state, instead of after the input device has already been registered.
In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the mlxbf-pmc driver and return -ENODEV when the companion is missing.
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 81.2%.
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 78.9%.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Internet Explorer 8 through 10 contain a memory corruption vulnerability allowing remote code execution via crafted websites, used in targeted attacks against defense and aerospace organizations in 2013.
Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 67.2%.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 72.1%.
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 81.3%.
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.5%.
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not properly handle exceptions, which allows local users to gain privileges or. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available.
Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 51.7%.
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.exe 65.50.2011.18049 in KingView 6.55 allows remote. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 58.3%.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 86.1%.
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 84.4%.
Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 78.1%.
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 79.1%.
An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 67.9%.
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft XML Core Services 3.0 through 6.0 access uninitialized memory locations, allowing remote attackers to execute code or cause memory corruption through a crafted website, actively exploited before patch availability.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 69.6%.
Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 83.6%.
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.7%.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Denial of service in Grafana (fixed in Alpine Linux package grafana 12.4.4-r0) allows remote unauthenticated attackers to exhaust server resources and render the observability dashboard unavailable. The flaw is classified as uncontrolled resource consumption (CWE-400) with a network-reachable, no-privilege, no-interaction attack profile (CVSS 7.5, availability-only). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Grafana prior to 12.4.4-r0 allows remote unauthenticated attackers to disrupt service availability over the network with low complexity. Alpine Linux has shipped the fixed package version, and no public exploit identified at time of analysis. Despite tagging suggesting information disclosure, the CVSS vector indicates an availability-only impact, which warrants clarification from the vendor advisory.
Denial of service in Grafana OSS (multiple 11.6.x, 12.2.x, 12.3.x, 12.4.x and 13.0.x branches) lets remote attackers exhaust server resources and crash or hang the analytics dashboard, per an Alpine Linux advisory that ships the fix in package build 12.4.4-r0. The flaw is an uncontrolled-resource-consumption (CWE-400) condition scored CVSS 7.5 with availability-only impact; no confidentiality or integrity loss occurs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.36%, 28th percentile).
Denial of service in Samba on Alpine Linux causes the smbd service to crash via a NULL pointer dereference triggered by remote unauthenticated network requests. Alpine Linux has issued a fix in samba 4.23.8-r0, and no public exploit identified at time of analysis. The CVSS 7.5 score reflects high availability impact with a network attack vector requiring no privileges or user interaction.
Denial of service in the ack code-search tool (App::Ack / ack3) before v3.10.0 allows a project-scoped .ackrc file to trigger memory exhaustion by setting an unbounded -A/-B/-C context value. When a victim runs ack inside a directory containing an attacker-supplied .ackrc, the oversized context request forces unbounded buffering and can exhaust process/host memory. No public exploit identified at time of analysis; not listed in CISA KEV.
Unbounded memory growth in the Protocol::HTTP2 Perl library (versions prior to 1.14) allows a remote unauthenticated attacker to exhaust server memory by cycling large numbers of HTTP/2 streams. The library's stream-state tracker accumulated closed-stream records indefinitely with no eviction, enabling a slow-burn denial-of-service attack against any application embedding this module as its HTTP/2 implementation. Fixed in Protocol::HTTP2 1.14 (Alpine Linux perl-protocol-http2 1.14-r0); no public exploit code or active exploitation identified at time of analysis.
Denial of service in the Perl HTTP::Date module (libwww-perl's parse_date/str2time) before version 6.08 lets remote attackers exhaust CPU by submitting hostile Date-header-style strings that trigger quadratic regex backtracking (ReDoS). Any application that feeds untrusted date strings - HTTP clients, servers, and mail tooling built on libwww-perl - is affected; a ~40 KB crafted string can burn tens of seconds of CPU per request. No public exploit identified at time of analysis, though a regression test demonstrating the pathological input ships with the fix, and EPSS is low (0.21%).
Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.
Denial of service in the Suricata SMB parser lets remote attackers exhaust sensor CPU and memory by driving sustained one-directional SMB traffic through an affected sensor. Suricata versions prior to 7.0.17 and 8.0.6 retain force-completed transactions on flows where payload is seen in only one direction (including async-oneside flows), because cleanup waits for inspection in the direction that never arrives; transaction creation paths can then exceed the intended SMB_MAX_TX bound while cleanup repeatedly rescans the growing list, producing unbounded per-flow state. No public exploit identified at time of analysis, and exploitation is constrained (AC:H) to deployments that both enable SMB app-layer inspection and observe one-directional visibility such as async-oneside or asymmetric routing, making this a genuine but moderate-priority monitoring-plane risk rather than a compromise of confidentiality or integrity.
Memory exhaustion and denial of service in FluidSynth 2.5.0 through 2.5.5 allows an attacker to crash any application that parses an attacker-supplied SoundFont 2 file. The SF2 parser derives the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without first rejecting chunks smaller than a single record, so a zero-sized DMOD chunk underflows the unsigned subtraction to UINT_MAX and the loader attempts to allocate billions of SFMod structures until process memory is exhausted. Rated CVSS 6.2 (AV:L/AC:L/PR:N/UI:N, availability-only), the issue requires only that a crafted .sf2 file be loaded locally (no privileges and no user interaction beyond opening the file), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-released patch is version 2.5.6.
A 32-bit integer overflow in FluidSynth's native DLS parser lets a crafted DLS sound-bank file bypass the ptbl chunk-size check, triggering an approximately 4 GB pool-cue allocation and billions of out-of-bounds reads that crash the process, producing a denial of service against the affected 2.5.0 through 2.5.5 releases. Exploitation requires the library to be built with enable-native-dls=ON and an attacker-supplied DLS file to be opened by the application; the CVSS vector indicates no privileges are required (PR:N), and no public exploit code was identified at time of analysis. The vendor has fixed the flaw in FluidSynth 2.5.6.
FluidSynth builds compiled with the native DLS parser enabled can be driven into a local denial of service by a crafted DLS SoundFont file: an integer overflow in the parser's articulation-chunk size check lets the loader run roughly a billion out-of-bounds 12-byte iterations, causing a crash or hang. The flaw affects versions 2.5.0 through 2.5.5 and is fixed in 2.5.6; exploitation requires the target to be built with the non-default CMake option enable-native-dls set to ON and to load the attacker-supplied file (unauthenticated per the CVSS PR:N vector, but the attack vector is local and the malicious file must reach the application). No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - there is no code execution or data disclosure.
Autobahn Python releases prior to 26.7.1 enforce the maxMessagePayloadSize receive limit against the compressed on-the-wire frame length rather than the inflated message size, so an unauthenticated remote client can send a small permessage-deflate frame that decompresses far past the configured application message cap and is nonetheless allocated, reassembled, validated, and handed to application callbacks. The impact is resource-exhaustion pressure scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, availability-only), and the advisory does not establish confidentiality or integrity impact despite the general 'Information Disclosure' tag; no public exploit identified at time of analysis. Exposure is limited to WebSocket endpoints that negotiate permessage-compress (permessage-deflate or the bzip2/snappy/brotli backends) - endpoints that do not accept a compression extension for the connecting client are unaffected.
Denial of service in IBM i 7.3, 7.4, 7.5, and 7.6 allows unauthenticated attackers on an adjacent network segment to disrupt the integrated FTP server by sending authentication commands that are not properly validated. Because the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, the credential-free USER/PASS handshake is the likely trigger path, but realistic exposure is confined to LAN or same-broadcast-segment reachability rather than arbitrary internet access, and there is no confidentiality exposure or code execution evidenced. IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
In osmo-iuh from 1.10.0 through 1.14.5 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
Denial of service in AnyIO versions prior to 4.14.2: the process-pool implementation behind to_process.run_sync() starts worker processes with stderr wired to a pipe that the parent never drains, so a worker that writes more than the roughly 64 KiB pipe buffer to sys.stderr blocks on write() before it can return its stdout protocol response, leaving the awaiting process-pool call hung indefinitely. Applications are exposed only if they actually use AnyIO's process pool and run worker functions whose stderr volume can be driven by untrusted or faulty input - for example verbose tracebacks or logging produced by attacker-influenced data - while code paths that never touch to_process, or that already close/redirect worker stderr, are unaffected. Impact is limited to availability (hang), with no confidentiality, integrity, or code-execution effect, and per the vendor and independent assessment this is a local, low-privilege-scoped flaw (CVSS:4.0 AV:L/PR:L and CVSS:3.1 AV:L/PR:L, A:H); no public exploit code exists and no active exploitation has been confirmed (no public exploit identified at time of analysis).
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop by a malicious or compromised MQTT broker that replies to a client UNSUBSCRIBE exchange with a malformed packet containing a zero-length topic followed by trailing data. The defect is CWE-835 in nni_mqtt_msg_decode_unsubscribe() (nng/src/supplemental/mqtt/mqtt_codec.c), where a failed read_uint16() during topic counting leaves buf.curpos unchanged while topic_count keeps incrementing, so the parse loop never terminates; when automatic reconnection is enabled the client re-enters the same state repeatedly, producing a sustained denial of service against the client itself. The independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - a low-impact, low-priority availability issue with an inverted threat model, since the victim is the client and the attacker must supply the hostile endpoint; no public exploit code was identified at time of analysis and the issue is not in CISA KEV. Vendor-released patch: 0.24.14.
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PUBLISH or SUBSCRIBE packets containing a large number of User Properties. Each property is inserted via property_append(), which re-walks the entire linked list, so a single packet with many properties forces quadratic (O(N²)) CPU work in the decoder; repeating the packet sustains the denial of service. The vendor has released a fix in 0.24.14, and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is availability-only and rated low, with the independent assessment noting that effectiveness depends on how many properties can be packed into a packet and on continued resending.
An integer-overflow flaw in libheif's RGB-to-YCbCr conversion path (libheif/color-conversion/rgb2yuv.cc) can crash an application that encodes extremely large RGB images constructed via heif_image_create() and heif_image_add_plane() before calling heif_context_encode_image(); a 32-bit stride field wraps, so the conversion loop computes an invalid input pointer and reads past the end of the allocated interleaved plane. Affected deployments are those running libheif versions prior to 1.19.6 that expose the ENCODE path to caller- or attacker-influenced image dimensions - pure decode/parsing workflows are not affected. Impact is limited to process termination (no code execution, no data disclosure), and no public exploit code was identified at time of analysis.
Denial of service in OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1 occurs when the library processes a truncated TGA file while writing GIF output, triggering a signed 32-bit integer overflow in GifSplitPalette() that leads to an out-of-bounds read (CWE-125) and a process crash. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates the attacker is unauthenticated (PR:N) but requires local access and user interaction, with no remote or unauthenticated network trigger. No public exploit code or active exploitation has been identified; this is a low-priority hardening issue for workflows that transcode untrusted images to GIF.
Denial of service in OpenImageIO prior to 3.1.16.0: processing a crafted ZIP/Deflate-compressed TIFF while TIFF multithreading is enabled can crash the image-reading process. The bug is an object destruction-order error in TIFFInput::read_native_scanlines(), where an error path returns before queued asynchronous strip-decompression tasks are joined, letting worker tasks touch stale stack and heap storage (use-after-scope). The assessed vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - no privileges required, but a user or pipeline must open the malicious file (UI:R) and the crash depends on a narrow timing window (AC:H); impact is availability only, with no memory disclosure or code execution, and no public exploit identified at time of analysis.
Authenticated users on the IBM TS4300 tape library management interface can degrade the appliance's email notification service by triggering requests faster than it can handle, due to missing interaction-frequency (rate) controls in firmware versions 1.1.0.1 through 1.7.1.1. The impact is confined to availability of the email/alerting subsystem (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); the data path, stored data, and integrity are unaffected, and valid credentials are a hard prerequisite. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a low-priority, patch-available hardening issue.
Denial of service in OpenImageIO's PSD reader allows a crafted PSD file carrying an invalid color_mode value to index beyond the fixed color-mode tables, producing a global out-of-bounds read and potentially a bogus allocation that crashes the reading process. The exposure is narrow: the raw path is only reachable when the non-default oiio:RawColor or psd:RawData option is explicitly enabled, and an attacker must get a target application or automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5, CWE-125), so impact is availability-only with no confidentiality or integrity effect. No public exploit has been identified at time of analysis, and vendor-released fixes exist in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Stack-based buffer overflow in OpenImageIO's Cineon image reader (CineonInput::open()) lets a crafted .cin file that declares more than the format's maximum of eight channels overwrite stack pointers and corrupt adjacent memory, crashing the application that processes it. Exploitation requires the victim or an automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, 6.1), so it cannot be triggered remotely without inducing file ingestion; the assessed impact is denial of service with only low integrity risk and no confidentiality loss. No public exploit identified at time of analysis and the issue is not in CISA KEV; vendor fixes shipped in OpenImageIO 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
Stack exhaustion in OpenImageIO's FITS image reader (all releases prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1) lets a crafted FITS stream crash a parsing process by driving FitsInput::read_fits_header() into unbounded recursion. The trigger is a stream of consecutive 2880-byte header blocks that never contain the mandatory END keyword, so each block causes another self-call until the application stack is consumed; remote, unauthenticated attackers can deliver the payload but successful exploitation requires the victim to open or ingest the file (UI:R), and the resulting impact is availability-only with no code execution or data disclosure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released fixes are available.
Denial of service in WinFsp through 2.2.26215 allows an authenticated, unprivileged local user to crash the Windows kernel by issuing FSP_IOCTL_TRANSACT requests to the WinFsp control device, triggering a null pointer dereference in the driver's Fast I/O device control handler. The vulnerability requires local access (PR:L) and a system with WinFsp installed; it results only in a system crash with no data exposure or code execution. No public exploit code has been identified at time of analysis, and the flaw is not known to be actively exploited.
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. This availability-only issue affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and Red Hat Hardened Images, and exploitation requires a victim to open a malicious PDF (UI:R, AV:L, PR:N - no privileges required). No public exploit identified at time of analysis, and no confirmed active exploitation.
Memory-exhaustion denial of service in ImageMagick before 7.1.2-31 stems from the Ultra HDR (UHDR) encoder omitting resource-policy checks while allocating the pixel buffer, so a crafted UHDR image can push allocations past the memory/area/disk limits an operator configured in policy.xml. The flaw is remotely reachable without authentication (CVSS 4.0 vector PR:N/UI:N) in any application that routes untrusted images through ImageMagick's UHDR encoding path, but the independent assessment rates it low priority: AC:H and AT:P reflect a niche code path and a crafted image that must reliably defeat the policy logic, and impact is confined to availability (VC:N/VI:N/VA:L) with no confidentiality, integrity, or code-execution effect. Vendor patch 7.1.2-31 is available; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A division-by-zero in ImageMagick's FLIF encoder allows unauthenticated remote attackers to crash the encoder process by supplying an image whose ticks-per-second field yields a zero divisor, causing a denial of service. Affected versions are ImageMagick before 7.1.2-31 (7.x) and before 6.9.13-56 (6.x); exploitation requires that a target application encode attacker-influenced data to FLIF, a relatively uncommon output format, and no public exploit code or active exploitation has been identified at time of analysis.
ImageMagick's PNM (Netpbm) image coder can be crashed via a NULL pointer dereference when processing a specially crafted or sufficiently large PNM image that pushes the library to its configured memory/resource limit at a specific allocation point where the failed allocation is never checked. The flaw affects ImageMagick releases before 7.1.2-31 on the 7.x branch and before 6.9.13-56 on the legacy 6.x branch, and the outcome is limited to a denial of service - a single-process crash that can be restarted - with no data exposure, integrity loss, or code execution. Severity is low (vendor CVSS 4.0 base 2.3; independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L with high attack complexity and partial prerequisite conditions), no public exploit code was identified at time of analysis, and a vendor-released patch is available.
Memory resource limits configured for ImageMagick are not enforced by the PCD coder (and, per the upstream advisory, the CUBE and HALD coders) when a specific command-line option is supplied, so a local user who can control ImageMagick invocation arguments can push the process past its intended policy limit and cause additional memory allocation. Impact is confined to limited availability degradation - no code execution, no data exposure, no integrity change - and the path is local-only with low privileges required (AV:L/PR:L in the assessed vector). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is rated low priority; vendor fixes 7.1.2-31 (7.x) and 6.9.13-56 (6.x) are available, and environments that invoke ImageMagick with fixed, non-user-controlled arguments are not exposed.
Memory corruption in ImageMagick's ImagesToBlob blob-conversion routine can crash an affected process on 7.x releases before 7.1.2-31 and 6.x releases before 6.9.13-56. The flaw is a use-after-free (CWE-416) in which a pointer is not updated correctly, and exploitation requires a crafted image to reach a local ImageMagick process or library call (CVSS 4.0 AV:L/AC:H/AT:P, PR:N), so no authentication is required but the attack surface is local and the trigger is difficult to satisfy reliably. Impact is confined to availability (VC:N/VI:N/VA:L) with no evidence of code execution or data exposure, and no public exploit identified at time of analysis; vendor patches are available.
Denial of service in Netty's HTTP/2 HPACK encoder (HpackEncoder) allows an unauthenticated remote attacker to force excessive CPU and memory consumption by sending SETTINGS frames that advertise an oversized MAX_HEADER_TABLE_SIZE, causing the encoder to retain an excessive number of unique header entries. The issue affects applications and Red Hat products that embed Netty and expose an HTTP/2 listener - including JBoss EAP 7 and 8, Keycloak, Red Hat Single Sign-On 7, AMQ Broker 7, Data Grid 8, Fuse 7, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Apicurio Registry 3, and Debezium 3 - while HTTP/1.1-only endpoints are not exposed. Impact is bounded to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CVSS 5.3) with no data disclosure or modification; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Unauthenticated remote attackers can inflate a plugin option in the Really Simple Security WordPress plugin (versions 8.1.6 up to but not including 9.8.3) by supplying arbitrary address values that the plugin uses as storage keys without validation, causing unbounded option growth and slower handling of missing pages. The impact is availability-only degradation (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity effect, and default configurations are reachable by network unauthenticated exploitation as long as the site is online. Publicly available exploit code exists and WPScan published the finding, but there is no indication of confirmed active exploitation (CISA KEV); sites running 9.8.3 or later are unaffected.
Null pointer dereference in Freedesktop Poppler 26.07.0 within JBIG2Stream::rewind lets an unauthenticated remote attacker deliver a crafted PDF containing a malformed JBIG2 stream that crashes applications using Poppler for parsing, resulting in a low-severity denial of service. The victim must open or render the document (UI:P), and there is no server-side auto-trigger unless a backend automatically renders untrusted PDFs; impact is limited to a process crash, with no code execution or information disclosure. Publicly available exploit code exists, and the vendor has released Poppler 26.08.0 with patch commit 5e49250f13b0390edeb3f90eb4c02c9941f97067 to address the issue.
Resource exhaustion in the VES Collector component of O-RAN-SC SMO OAM 2025-06-10 allows an authenticated remote attacker to cause a limited denial of service by submitting manipulated input that drives uncontrolled resource allocation. Publicly available exploit code exists, but the issue is low priority per CVSS 2.1 and the independent assessment, with impact limited to availability of the collector and no confidentiality or integrity effect. The project has been notified via a bug report and has not responded, so no vendor patch is confirmed.
Uncontrolled resource allocation in the VES Collector component of the O-RAN-SC SMO OAM stack (2025-06-10 snapshot) lets an authenticated, low-privilege remote user exhaust collector resources and degrade availability of the OAM event-streaming service. The impact is availability-only and partial (CVSS 4.0 score 2.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L), with no confidentiality or integrity effect. Publicly available exploit code exists and was published alongside an upstream bug report (Jira SMO-202) that the project has not responded to, so no vendor patch or fixed version is available; the issue is not reported as confirmed actively exploited (CISA KEV), and overall risk is low.
Uncontrolled resource allocation in the VES Collector component of O-RAN-SC SMO OAM (2025-06-10) lets remote, unauthenticated attackers exhaust resources and degrade availability, with no confidentiality or integrity impact (VC:N/VI:N/VA:L). The CVSS 4.0 base of 6.9 reflects network reachability with no privileges or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N) and a proof-of-concept exploit is publicly available via a GitHub gist, though there is no confirmed actively exploited (CISA KEV) status. The upstream project was notified through a bug report (LF-O-RAN-SC Jira SMO-204) but has not responded, so no vendor-released patch is identified at time of analysis; practical exposure is limited to deployments where the VES Collector is reachable on an internal telecom OAM/management plane.
Uncontrolled memory allocation in the VES Collector component of O-RAN-SC SMO OAM 2025-06-10 allows a low-privilege, authenticated remote user to drive excessive memory consumption by manipulating the additionalFields.padding argument in a submitted VES event, degrading collector availability. Publicly available exploit code exists and the issue was reported upstream (SMO-201) without a vendor response, so no patched release is confirmed. Impact is limited to availability (VA:L) with no confidentiality or integrity effect, and the overall severity is low per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
An out-of-bounds read in OpenImageIO's BMP reader allows a crafted palette BMP to crash any process that decodes it, causing denial of service. Affected are versions prior to 3.0.16.0 and 3.1.11.0: a malformed file whose DIB header sets the palette flag but supplies an empty color table, combined with RLE4 or RLE8 compression, drives BmpInput::read_native_scanline into an invalid palette lookup. Exploitation requires the victim to process the attacker-supplied image (for example via oiiotool or an application linked against OpenImageIO), making the realistic risk concentrated in automated or batch image-ingestion pipelines; no public exploit identified at time of analysis, and CISA KEV does not list this issue.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
Denial of service in rabbitmq-c (librabbitmq) versions prior to 0.16.0 lets an attacker-controlled or on-path AMQP server crash a connecting client during the login handshake by sending an undersized HEADER or METHOD frame. The malformed frame triggers an unsigned size_t underflow in the frame parser that defeats downstream bounds checks and causes an out-of-bounds read, terminating the client process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) the impact is purely availability, requiring the victim to initiate a connection (UI:R); no public exploit identified at time of analysis, and TLS with proper certificate validation neutralizes the on-path variant.
Denial of service in the GNU C Library (glibc) DNS stub resolver causes any process that resolves names to abort via an assertion failure when the search list loaded from /etc/resolv.conf or the LOCALDOMAIN environment variable contains a single domain of roughly 200 characters or more; affected versions are 2.26 through 2.44. The weakness is reachable by an unauthenticated attacker on the adjacent network (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.3) only where search domains are populated from attacker-influenced DHCP or VPN configuration and the network-configuration software does not reject the over-length value; local exploitation requires the ability to write /etc/resolv.conf or set LOCALDOMAIN. Impact is limited to process termination (no code execution, data disclosure, or integrity impact), and no public exploit code was identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in update_tg_cfs_runnable() A divide-by-zero crash is observed when running hackbench: [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ [14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f/0x3e0 [14697.506799] <TASK> [14697.507411] __dequeue_task+0x2b4/0xc70 [14697.508677] dequeue_task_fair+0x36/0x370 [14697.509047] dequeue_task+0x101/0x2f0 [14697.509426] __schedule+0x1b1/0x1a00 [14697.510868] anon_pipe_read+0x3da/0x450 [14697.511400] vfs_read+0x361/0x390 [14697.512053] __x64_sys_read+0x19/0x30 The divide-by-zero happens here: if (scale_load_down(gcfs_rq->load.weight)) { load_sum = div_u64(gcfs_rq->avg.load_sum, scale_load_down(gcfs_rq->load.weight)); } gcfs_rq->load.weight is an insane large value and is truncated to the lower 32 bits by div_u64, which happen to be 0. Using AI for investigation, the cause is a u32 overflow in update_tg_cfs_runnable(), and flat pickup became a victim when using tg_tasks(): u32 new_sum, divider; ... new_sum = se->avg.runnable_avg * divider; <-- boom The following sequence shows how this triggers the crash: propagate_entity_load_avg() update_tg_cfs_runnable() # u32 overflow corrupts runnable_sum __update_load_avg_cfs_rq() ___update_load_avg() # computes insane runnable_avg update_tg_load_avg() # propagates to tg->runnable_avg update_cfs_group() calc_concur_shares() tg_tasks() # long-to-int truncation, negative nr reweight_entity() # corrupted se->load.weight update_load_add() # corrupted cfs_rq->load.weight propagate_entity_load_avg() update_tg_cfs_load() div_u64() # divide-by-zero Fix by widening new_sum from u32 to u64 (no need to force tg_tasks() to return unsigned long after this fix)
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix NPD issue on partial unmap of an evicted BO This commit fixes the NULL pointer dereference issue that would have happened on the split of GPU mapping due to partial unmap of an evicted BO. There is a logic to handle the partial unmap of huge pages when the GPU mapping is split. That logic was not being completely skipped for the VMA of an evicted BO and that resulted in a NPD possibility for the 'bo->backing.pages' pointer, which is set to NULL when pages of a BO are released on eviction. Following dump was seen when a partial unmap was exercised for an evicted BO. Unable to handle kernel paging request at virtual address 0000000000002000 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008842e8000 [0000000000002000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP <snip> pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : iova_mapped_as_huge_page+0x20/0x68 [panthor] lr : panthor_gpuva_sm_step_remap+0x39c/0x498 [panthor] sp : ffff800086193920 x29: ffff800086193920 x28: ffff800086193a18 x27: ffff800086193b80 x26: 0000000000400000 x25: 0000000000810000 x24: 0000000000400000 x23: ffff000808af1800 x22: 0000000000a00000 x21: ffff800086193a00 x20: ffff000806fd3f00 x19: 0000000000410000 x18: 00000000ffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff800083ce2d83 x14: 0000000000000000 x13: 3120646574636976 x12: 6520303030303138 x11: 2d30303030313420 x10: ffff8000836e6c80 x9 : ffff80007bfc889c x8 : 3fffffffffffefff x7 : ffff8000836e6c80 x6 : 0000000000000000 x5 : ffff00097ef19088 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000010000 x1 : 0000000000000400 x0 : 0000000000000000 Call trace: iova_mapped_as_huge_page+0x20/0x68 [panthor] (P) op_remap_cb.isra.0+0x70/0xb0 __drm_gpuvm_sm_unmap+0xf8/0x1c0 drm_gpuvm_sm_unmap+0x40/0x60 panthor_vm_exec_op+0xa0/0x168 [panthor] panthor_vm_bind_exec_sync_op+0x8c/0xb8 [panthor] panthor_ioctl_vm_bind+0xbc/0x170 [panthor] drm_ioctl_kernel+0xc0/0x140 drm_ioctl+0x20c/0x500 __arm64_sys_ioctl+0xb4/0x118 invoke_syscall+0x5c/0x120 el0_svc_common.constprop.0+0x48/0xf8 do_el0_svc+0x28/0x40 el0_svc+0x38/0x128 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x198/0x1a0 Code: 8b030021 cb020021 f940b800 d34cfc21 (f8617801) ---[ end trace 0000000000000000 ]--- v2: Fix indentation
In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC The loop iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed by XCC ID >= 2. Extend the loop to cover all XCCs (AMDGPU_MAX_MES_PIPES * num_xcc), matching other per-XCC arrays.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device ACPI companion object need to verify its presence. asus_wireless_probe() returns success when acpi_match_acpi_device() finds no match, leaving behind an input device that never reports anything because the notify handler is not installed. Worse, when the driver is force-bound to a device without an ACPI companion, probe still succeeds and stores a NULL companion pointer, which asus_wireless_remove() later passes to acpi_dev_remove_notify_handler(), leading to a NULL pointer dereference on unbind. Return -ENODEV when the device does not match the ID table. This also covers the missing-companion case, because acpi_match_acpi_device() rejects a NULL device. Perform the check before allocating any driver state, instead of after the input device has already been registered.
In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the mlxbf-pmc driver and return -ENODEV when the companion is missing.