Memory Corruption
Monthly
Buffer overflow in Linux kernel's AMD CCP (Cryptographic Coprocessor) driver leaks kernel memory to userspace when retrieving PEK CSR (Platform Endorsement Key Certificate Signing Request). Affecting Linux kernel 4.16+ through 7.0.x, the vulnerability allows local authenticated users to read arbitrary kernel memory due to improper error handling when firmware returns invalid buffer length requirements. Patches available across stable branches (6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1-rc1). EPSS score of 0.02% indicates minimal observed exploitation probability, though the CVSS 7.1 reflects significant confidentiality impact. No CISA KEV listing or public exploit identified at time of analysis.
Information disclosure in Linux kernel's AMD Cryptographic Coprocessor (CCP) driver allows local authenticated attackers to leak kernel memory to userspace via out-of-bounds read. When retrieving PDH certificates through SEV ioctl, the driver incorrectly copies data to userspace even after firmware command failures, potentially reading 2084+ bytes beyond allocated buffer boundaries. EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation probability. Vendor patches available across multiple stable kernel branches (6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1-rc1) per upstream commits.
Buffer overflow in Linux kernel CCP SEV driver allows local authenticated users to leak kernel memory to userspace. When the PSP firmware command to retrieve SEV CPU ID fails due to insufficient buffer size, the driver attempts to copy data beyond the allocated kernel buffer boundary, exposing up to 64 bytes of kernel memory. Exploitation requires local access with low privileges (CVSS PR:L) to invoke the SEV ioctl interface. EPSS score is very low (0.02%, 5th percentile) indicating minimal real-world exploitation observed. No public exploit identified at time of analysis, though the KASAN stack trace in the CVE description provides a clear exploitation path. Patches available across multiple stable kernel branches (6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1-rc1).
Buffer overflow in Linux kernel rxrpc subsystem allows local authenticated users to trigger memory corruption via malformed key payloads. The non-XDR parsing path in rxrpc_preparse() fails to validate ticket length against AFSTOKEN_RK_TIX_MAX, enabling unprivileged users to supply oversized tickets that cause WARN_ON() triggers and potential memory corruption when keys are read. Vendor patches available for kernel versions 6.6.136, 6.12.84, 6.18.25, 7.0.2, and 7.1-rc1. EPSS score of 0.02% indicates low observed exploitation probability, with no public exploit identified at time of analysis.
Use-after-free in Linux kernel virt_wifi driver allows local authenticated users to trigger memory corruption during ethtool operations on virtual WiFi devices being unregistered. The vulnerability stems from improper device parent reference handling via SET_NETDEV_DEV, where ethnl_ops_begin() calls pm_runtime_get_sync() on already-freed memory when a virt_wifi device unregisters concurrently with ethtool operations. Patches are available across multiple stable kernel branches (5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit identified at time of analysis, though CVSS 7.8 reflects potential for complete system compromise if successfully triggered.
Use-after-free in Linux kernel's MANA network driver allows local authenticated attackers to corrupt memory and potentially execute code with kernel privileges. The flaw occurs when auxiliary_device_add() fails in add_adev(), triggering cleanup that frees memory still referenced by subsequent error-handling code. Patches available across stable kernel branches (6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis.
Race condition in Linux kernel ATM LEC driver allows local attackers with low privileges to trigger use-after-free memory corruption in sock_def_readable(), potentially achieving arbitrary code execution, privilege escalation, or denial of service. The flaw affects systems using ATM (Asynchronous Transfer Mode) LAN Emulation Client functionality, present since Linux kernel version 2.4 (commit 1da177e4c3f4). EPSS score of 0.02% (7th percentile) suggests low probability of mass exploitation. Vendor patches available across all maintained stable branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). Not listed in CISA KEV; no public exploit code identified at time of analysis.
Use-after-free in Linux kernel HID subsystem allows local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service when force feedback initialization fails on Logitech G920 racing wheels. The vulnerability occurs when userspace continues accessing freed memory structures (sysfs and /dev/input) after initialization errors. Vendor patches available across multiple stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates very low probability of mass exploitation, consistent with hardware-specific local attack surface requiring physical device presence.
Out-of-bounds memory writes in Linux kernel HID multitouch driver allow local authenticated users to achieve code execution or crash systems via malicious USB/HID devices. The vulnerability exists in the HID multitouch report parsing logic where mismatched report IDs in feature requests can confuse the HID core. Vendor-released patches are available across multiple kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score is low (0.02%, 7th percentile), indicating minimal observed exploitation attempts. No public exploit code identified at time of analysis.
Memory corruption in Linux kernel IPv6 ICMP error handling allows remote unauthenticated attackers to potentially achieve code execution or information disclosure. The vulnerability arises from incomplete control block (CB) sanitization when converting IPv4 ICMP errors to ICMPv6, enabling forged CIPSO options in outer IPv4 packets to manipulate inner IPv6 packet parsing. This can trigger out-of-bounds memory access extending into skb_shared_info structures. Despite CVSS 9.8 critical rating, EPSS exploitation probability is extremely low (0.02%, 7th percentile), no public exploit code exists, and CISA has not listed this as actively exploited. Patches are available across all supported kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0).
A stack-based buffer overflow in the Linux kernel's IPv6-to-IPv4 tunneling (ip6_tunnel) code allows remote unauthenticated attackers to achieve arbitrary code execution. The vulnerability occurs when ip4ip6_err() passes a cloned skb with IPv6-formatted control buffer data to icmp_send(), which misinterprets it as IPv4 control buffer data. This type confusion causes __ip_options_echo() to read attacker-controlled packet data as a length value and copy up to that many bytes into a fixed 40-byte stack buffer, enabling remote exploitation with no prerequisites. EPSS score of 0.02% suggests limited exploitation probability despite critical CVSS 9.8 rating. Vendor-released patches are available across all maintained kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0).
Use-after-free in Linux kernel netfilter subsystem allows local authenticated attackers to corrupt memory and potentially execute arbitrary code with kernel privileges. The vulnerability occurs when unregistering connection tracking helpers - expectations referencing the helper survive cleanup and later dereference the freed helper object during expectation dumps or new connection establishment. Vendor-released patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% indicates low observed exploitation probability; no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.
Stack buffer overflow in Linux kernel Bluetooth MGMT subsystem allows local authenticated attackers to execute arbitrary code with elevated privileges. The vulnerability stems from insufficient validation of the encryption key size (enc_size) parameter when loading Long Term Keys (LTKs) via the Bluetooth management interface. When processing LE LTK requests, the kernel uses the attacker-controlled enc_size value to perform stack operations against a fixed 16-byte buffer, enabling stack corruption through oversized values. Vendor-released patches are available across all active kernel branches. EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit has been identified at time of analysis, though the attack complexity is low once local authenticated access is obtained.
Use-after-free in Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve arbitrary code execution with high privileges. The vulnerability exists in set_cig_params_sync where hci_conn objects can be freed or modified concurrently during lookup and field access due to inadequate locking. Vendor patches are available across multiple stable kernel branches (6.6, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% indicates low observed exploitation probability, no CISA KEV listing, and no public exploit identified at time of analysis.
Use-after-free in Linux Kernel Bluetooth stack allows adjacent network attackers to execute arbitrary code, escalate privileges, or cause denial of service without authentication. The vulnerability exists in hci_le_remote_conn_param_req_evt where hci_conn lookup and field access occurs outside the hdev lock protection, enabling concurrent memory corruption. Patches are available across multiple stable kernel branches (6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0). EPSS score of 0.02% indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in Linux kernel's BPF sockmap implementation allows local authenticated attackers to corrupt memory and potentially execute arbitrary code with kernel privileges. The vulnerability occurs in sk_psock_verdict_data_ready() when handling AF_UNIX sockets, where sk->sk_socket can be accessed after being freed following sock_orphan(). This affects Linux kernel versions 5.15 through 6.19.12, with patches available for stable branches 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0. EPSS score of 0.02% indicates very low observed exploitation probability in the wild, and no active exploitation or public exploit code has been identified at time of analysis.
Use-after-free in Linux kernel macb driver allows local authenticated attackers to cause denial of service or potentially escalate privileges during module removal. The vulnerability occurs in the PCI glue driver when platform_device_unregister() triggers a runtime resume callback that attempts to access already-freed clock structures. EPSS score is low (0.02%) with no evidence of active exploitation. Vendor patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0).
A heap buffer overflow in the Linux kernel's wilc1000 WiFi driver allows local authenticated users to trigger memory corruption via crafted SSID scan requests. The driver miscalculates buffer size due to u8 integer overflow (330 bytes wrapping to 74), causing kmalloc to allocate 75 bytes while memcpy writes up to 331 bytes - a 256-byte overflow. Patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.03% (9th percentile) suggests low likelihood of widespread exploitation, and CISA KEV does not list this CVE, indicating no confirmed active exploitation at time of analysis.
Stack buffer overflow in Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve code execution, privilege escalation, or denial of service through malformed ISO socket parameters. The vulnerability occurs when binding an ISO Bluetooth socket with up to 31 BIS entries while the hci_le_big_create_sync() function only allocates stack space for 17 entries, resulting in a 14-byte overflow that corrupts adjacent stack memory. Patches are available across multiple kernel versions (6.12.81, 6.18.22, 6.19.12, 7.0), with EPSS indicating 0.02% exploitation probability and no active exploitation confirmed.
Use-after-free in Linux kernel GPIB subsystem allows local authenticated attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers when concurrent IBCLOSEDEV calls free descriptors still in use by I/O operations. EPSS probability is very low (0.02%, 4th percentile), indicating minimal observed exploitation activity. Vendor patches available for stable branches 6.18.22, 6.19.12, and mainline 7.0 via commits cae26eff, 28c75dd1, and d1857f82.
Use-after-free condition in Linux kernel USB Test and Measurement Class (USBTMC) driver allows local authenticated attackers to execute arbitrary code with elevated privileges. The vulnerability occurs when the usbtmc_release function fails to properly flush pending anchored URBs, leaving dangling references that can be exploited in the HCD giveback path. Vendor patches are available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0). Despite the high CVSS score of 7.8, the EPSS exploitation probability is very low at 0.02% (7th percentile), indicating limited real-world targeting, and no active exploitation or public POC has been identified.
Buffer overflow in Linux kernel COMEDI me_daq driver allows local authenticated users to achieve arbitrary code execution with kernel privileges. The me2600_xilinx_download() function fails to validate firmware file length before reading data streams, enabling out-of-bounds memory access during firmware loading operations. Patches available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates low probability of widespread exploitation despite high CVSS 7.8 rating, and no active exploitation or public exploit code identified at time of analysis.
Out-of-bounds write in Linux kernel comedi me4000 driver firmware loader allows local authenticated users to achieve high-impact code execution, data corruption, or system crash. The me4000_xilinx_download() function blindly trusts firmware file format headers without validating buffer boundaries, reading a length field from the first 4 bytes and then reading that many bytes from offset 16 without checking total file size. Patch available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability despite CVSS 7.8 rating. No public exploit code or active exploitation confirmed.
Memory corruption in the Linux kernel zynqmp_nvmem driver allows local authenticated users to achieve privilege escalation through undersized DMA buffer exploitation. The vulnerability stems from incorrect buffer size calculations in dma_alloc_coherent and memcpy operations, enabling heap or memory corruption that can lead to complete system compromise. With a 7.8 CVSS score but only 0.02% EPSS (5th percentile), this represents a high-severity issue affecting specific Xilinx Zynq UltraScale+ deployments rather than a widespread exploitation target. Patches available across multiple stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0) with upstream fixes confirmed in git commits.
Use-after-free in Linux kernel thermal subsystem allows local attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability stems from race conditions between thermal zone removal and power management resume operations, where delayed work items can continue executing after thermal zone objects are freed. EPSS score of 0.02% (5th percentile) suggests low probability of mass exploitation despite high CVSS severity. Vendor patches available across multiple stable kernel branches (6.12.83, 6.18.22, 6.19.12, 7.0) via upstream commits. No active exploitation confirmed in CISA KEV at time of analysis.
Local privilege escalation via stack out-of-bounds write affects the f_uac1_legacy USB Audio Class 1.0 gadget driver in the Linux kernel, where f_audio_complete() memcpy's a host-controlled req->length into a fixed 4-byte stack variable without validation. A device operating in USB gadget/peripheral mode can be driven by a malicious or crafted USB host to corrupt kernel stack memory, yielding CVSS 7.8 (High) with full confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and EPSS is negligible (0.02%), but the flaw is upstream-patched across many stable trees.
Remote denial of service in FRRouting stable/10.0 allows unauthenticated attackers to crash the BGP daemon via malformed FlowSpec NLRI messages. The off-by-one vulnerability in bgp_flowspec_op_decode() enables out-of-bounds writes when parsing crafted BGP FlowSpec components, causing process termination. EPSS exploitation probability data not available, but SSVC marks this as automatable with partial technical impact. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting theoretical rather than actively exploited risk.
Buffer overflow in Linux kernel Xen hypervisor interface allows local authenticated users to achieve arbitrary code execution with high privilege escalation impact. The vulnerability stems from improper handling of non-NUL-terminated build ID data from HYPERVISOR_xen_version(XENVER_build_id) in drivers/xen/sys-hypervisor.c, where sprintf reads past buffer boundaries seeking a NUL terminator. Affects Linux kernel versions from 5.10 through 7.0 series when running as Xen domain. Vendor-released patches available across all affected stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3). EPSS score of 0.08% (23rd percentile) indicates low probability of mass exploitation despite high CVSS 7.8, reflecting specialized Xen-only attack surface. No public exploit identified at time of analysis.
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
Renderer-level arbitrary code execution in Google Chrome's Media component affects all desktop builds prior to 147.0.7727.138, where a use-after-free (CWE-416) lets a remote attacker run code inside the browser sandbox when a victim loads a crafted HTML page. Google's own Chrome team reported it and Chromium rated it Medium severity because execution is confined to the sandboxed renderer rather than the host. There is no public exploit identified at time of analysis, and EPSS is very low at 0.04% (11th percentile), so no confirmed active exploitation exists.
Sandboxed remote code execution in Google Chrome's WebRTC component affects all desktop builds prior to 147.0.7727.138, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code within the renderer sandbox. Google rates the Chromium severity as High and has shipped a fix in the Stable channel; there is no public exploit identified at time of analysis and the EPSS probability is negligible (0.01%). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and code execution is confined to the sandbox unless chained with a separate sandbox-escape bug.
Sandboxed arbitrary code execution in Google Chrome for Android (WebView component) before 147.0.7727.138 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is very low (0.03%). Exploitation requires user interaction (visiting attacker content) and, per the description, execution is contained inside the sandbox rather than achieving a full sandbox escape.
Heap corruption in Google Chrome's Cast component (versions prior to 147.0.7727.138) allows an attacker positioned on the same local network segment to trigger a use-after-free via malicious network traffic, potentially leading to code execution within the browser process. The flaw was reported internally by the Chrome team and carries a High Chromium severity, but there is no public exploit identified at time of analysis and EPSS scores exploitation probability at effectively 0%. It is not listed in CISA KEV, and CISA's SSVC assessment marks exploitation as none and the attack as not automatable.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects all desktop versions prior to 147.0.7727.138, where a use-after-free flaw lets a remote attacker corrupt memory and run arbitrary code by sending malicious network traffic to an active remote-desktop session. Google rates it High severity; there is no public exploit identified at time of analysis and it is not in CISA KEV, with an EPSS probability of only 0.01% (2nd percentile). A vendor patch is available, and SSVC scores exploitation as none but technical impact as total.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a type confusion condition rated High severity by Chromium; there is no public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), and SSVC records no observed exploitation, though the technical impact is total. A vendor patch is available.
Remote code execution in Google Chrome's WebRTC component (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free memory corruption reported by Google's own Chrome team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none', indicating no observed exploitation despite the high technical severity.
Remote code execution in Google Chrome desktop before 147.0.7727.138 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the media component. Google rates the Chromium severity High and has shipped a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile). Notably the description confines code execution to inside the sandbox, so a separate sandbox-escape bug would be required for full host compromise.
Remote code execution in Google Chrome desktop before 147.0.7727.138 stems from a use-after-free in the browser's Codecs component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code within Chrome's renderer sandbox. Rated High severity by Chromium with CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.01%.
Sandboxed remote code execution in Google Chrome's Cast component affects all desktop builds prior to 147.0.7727.138, where a CWE-416 use-after-free lets an attacker on the same local network segment run arbitrary code inside the Chromium sandbox by sending malicious network traffic. Chromium rates the flaw High severity, but SSVC records no observed exploitation and EPSS is 0.00%, and no public exploit has been identified at time of analysis. Google has shipped a fixed Stable channel build.
Sandbox escape in Google Chrome's WebMIDI component (versions prior to 147.0.7727.138) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and carrying a CVSS of 8.3 with a scope-change (S:C) impact, it is a use-after-free (CWE-416) that Google has patched in the Stable channel. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
Sandbox escape in Google Chrome for Android (Media component) prior to 147.0.7727.138 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Chromium rates the severity High and a vendor patch is available; no public exploit is identified, EPSS is very low (0.01%, 1st percentile), and SSVC records exploitation status 'none'. It is a second-stage escape rather than an initial-access primitive, so it must be chained with a prior renderer compromise to have real impact.
Remote code execution in Google Chrome desktop builds prior to 147.0.7727.138 arises from a use-after-free in the Navigation component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer context. Chromium rates the flaw High severity and CVSS scores it 8.8, but there is no public exploit identified at time of analysis and EPSS is very low at 0.04% (11th percentile). A vendor patch is available and CISA's SSVC framework currently records exploitation as none.
Heap corruption in the GPU component of Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process escalate impact via a use-after-free triggered by a crafted HTML page. This is a High-severity Chromium memory-corruption bug reported internally by Chrome, with a vendor patch shipped in the April 2026 stable channel update and no public exploit identified at time of analysis. EPSS is minimal (0.01%) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Heap corruption in the Views UI component of Google Chrome on macOS (versions prior to 147.0.7727.138) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution. Rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC lists exploitation as none.
Remote code execution in Google Chrome desktop before 147.0.7727.138 arises from a use-after-free in the Animation component (CWE-416), allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though execution is constrained to inside the renderer sandbox. Chromium rates the severity High and a vendor patch is available; there is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC marks exploitation as none.
Sandbox escape in Google Chrome's ANGLE graphics abstraction layer (versions prior to 147.0.7727.138) lets an attacker who already controls a compromised renderer process break out of the browser sandbox by loading a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, it is a use-after-free (CWE-416) memory-corruption bug used as the second stage of a browser exploit chain. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA's SSVC framework records exploitation status as none.
Sandbox escape in Google Chrome's GPU process prior to 147.0.7727.138 lets a remote attacker corrupt memory via a use-after-free when a victim visits a crafted HTML page, potentially breaking out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to the scope change (S:C) inherent to a sandbox escape, though it requires user interaction (visiting a page). There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not on CISA KEV.
Sandbox escape in Google Chrome for Windows (versions prior to 147.0.7727.138) stems from a use-after-free in the Views UI component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader code execution on the host via a crafted HTML page. Chromium rates the internal severity as Critical, though the assigned CVSS is 7.5 due to the high attack complexity and the renderer-compromise prerequisite. This is a second-stage bug: there is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome on Windows (versions prior to 147.0.7727.138) leverages a use-after-free flaw in the browser's Accessibility component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain higher-privileged code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.8, the bug is patched but has no public exploit identified at time of analysis, and its EPSS score is very low (0.01%). This is a second-stage primitive typically chained with a separate renderer-RCE bug rather than exploited in isolation.
Heap corruption via use-after-free in Google Chrome (iOS) before 147.0.7727.138 allows a remote attacker to potentially execute code or crash the browser when a victim opens a crafted HTML page. Chromium rates the flaw Critical severity, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.01%). Exploitation requires the victim to load attacker-controlled web content (UI:R).
Remote code execution in Google Chrome (Canvas component) on Linux and ChromeOS before 147.0.7727.138 lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated Critical by Chromium, the flaw is a Canvas use-after-free (CWE-416); code execution is confined to the sandboxed renderer rather than the host OS. No public exploit identified at time of analysis and EPSS is very low (0.01%), though SSVC rates technical impact as total and the attack as automatable.
Memory corruption in Mozilla Firefox 150.0.0, Firefox ESR 140.10.0, Thunderbird 150.0.0 and Thunderbird ESR 140.10.0 stems from an out-of-bounds write (CWE-787) that Mozilla assessed as potentially exploitable for arbitrary code execution. Mozilla's own engineers discovered the bugs through internal fuzzing/auditing and shipped fixes in Firefox 150.0.1 and Firefox ESR 140.10.1; there is no public exploit identified at time of analysis and EPSS is very low (0.04%). The flaw affects the browser/mail-client rendering engine, so a victim who loads attacker-controlled web content is the realistic trigger despite the raw CVSS vector.
Out-of-bounds write in GNU C Library 2.2+ allows remote unauthenticated attackers to corrupt memory and potentially execute arbitrary code through specially crafted TSIG DNS records processed by deprecated ns_printrrf, ns_printrr, or fp_nquery functions. While these functions are deprecated, any application still using them for DNS record printing remains vulnerable to network-based attacks with low complexity and no authentication barriers. No public exploit identified at time of analysis, but the deprecated status suggests limited real-world exposure despite the network attack vector.
Buffer overflow in TH1520 AON firmware protocol driver allows local authenticated attackers with low privileges to execute arbitrary code and gain elevated system access. The vulnerability stems from unsafe pointer arithmetic when accessing the 'mode' field through the 'resource' pointer with unchecked offsets in the T-HEAD firmware driver. Patches available across stable kernel branches (6.18.23, 6.19.13, 7.0) with low EPSS score (0.02%) indicating minimal observed exploitation attempts, though CVSS 7.8 reflects high impact if exploited on affected T-HEAD TH1520 systems.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to corrupt memory and potentially disclose sensitive information through out-of-range writes when applications use v3, v5, or v6 UUID generation functions with caller-provided output buffers. The library fails to validate buffer boundaries, allowing partial writes beyond allocated memory regions. Vendor patch available in version 14.0.0 per GitHub security advisory GHSA-w5hq-g745-h8pq. No confirmed active exploitation (not in CISA KEV), and CVSS 4.0 Environmental Score suggests exploitation status is unproven (E:U).
Kernel memory corruption in Linux's MPTCP subsystem allows a use-after-free in __inet_lookup_established affecting IPv6 subflow sockets. Because mptcp_subflow_init() copied tcpv6_prot before inet6_init() had registered its slab cache, MPTCP IPv6 child sockets were allocated from kmalloc-4k without the SLAB_TYPESAFE_BY_RCU guarantee, so lockless RCU ehash lookups could dereference freed socket memory. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the flaw is remotely reachable via network traffic on hosts using MPTCP over IPv6.
Local privilege escalation and memory corruption in the Linux kernel's netfilter nf_tables conntrack (nft_ct) subsystem allows a local user with network-admin capability to trigger a use-after-free by destroying a conntrack timeout object while packets on other CPUs still reference it. The flaw stems from nft_ct_timeout_obj_destroy() calling kfree() immediately after nf_ct_untimeout() without waiting for an RCU grace period, leaving a dangling RCU-protected pointer read during nf_conntrack_tcp_packet(). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a KASAN reproducer ('exploit' task) is described in the commit and the bug is a classic exploitable CWE-416 heap UAF.
Memory leak (with latent use-after-free risk) in the Linux kernel's DAMON monitoring subsystem (mm/damon/stat) allows a local, privileged user to leak damon_ctx objects and potentially trigger use-after-free by repeatedly toggling the DAMON_STAT 'enabled' control after a damon_call() failure. Affected are kernels on the 6.17-6.19 line prior to the stable fixes; the flaw is classified CWE-416 (Use After Free). There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 4th percentile).
Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.
Use-after-free in Linux kernel's lan966x network driver allows local authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The flaw occurs in lan966x_fdma_reload() when RX buffer allocation fails - freed pages remain referenced by active DMA descriptors, causing hardware to write into memory now controlled by other kernel subsystems. Vendor patches available for stable branches 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis, but successful exploitation grants kernel-level privileges to local attackers.
Buffer overread in Linux kernel's rxgk_do_verify_authenticator() function allows remote unauthenticated attackers to trigger information disclosure and high-availability denial of service through network-accessible RxGK authentication handling. The vulnerability stems from improper buffer size validation before nonce verification in the RxRPC subsystem. Patches are available from the Linux kernel stable tree (versions 6.19.13, 6.18.23, and 7.0). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability, and no active exploitation or public POC has been identified. Despite the high CVSS base score of 8.2, real-world risk appears limited to environments using RxRPC with RxGK authentication.
Heap buffer overflow in Linux kernel USB/IP client allows malicious USB/IP servers to execute arbitrary code with kernel privileges via crafted RET_SUBMIT responses. A rogue server can specify a larger number_of_packets value than originally submitted, causing out-of-bounds writes when processing isochronous USB transfers. Patched in kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) suggests low probability of widespread exploitation despite CVSS 9.8 criticality, indicating this is primarily a risk in environments using USB/IP with untrusted servers rather than a general internet-facing threat.
Use-after-free in Linux kernel OCFS2 filesystem enables local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when filemap_fault() drops mmap_lock before returning VM_FAULT_RETRY, allowing concurrent munmap() to free the vm_area_struct while ocfs2_fault() still holds a dangling pointer. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis.
Use-after-free in Linux kernel memory management allows remote code execution when the folio_unmap_invalidate() function incorrectly accesses freed mapping structures. Kernel versions between 1da177e4c3f4 and patches 6.19.14/7.0.1 are affected. Exploitation probability is low (EPSS 2%, percentile 5%), with no confirmed active exploitation or public POC at time of analysis. Despite the critical CVSS 9.8 score indicating network-based unauthenticated attack, the description suggests this is a kernel memory corruption bug requiring local kernel code paths to trigger, not direct remote network exploitation - CVSS vector conflicts with technical nature and should be validated against vendor guidance.
Use-after-free in Linux kernel KVM x86 MMIO emulation allows local authenticated users with low privileges to potentially execute arbitrary code, escalate privileges, or cause denial of service. The flaw occurs when KVM's emulator initiates MMIO writes using on-stack variables that cross page boundaries between two MMIO pages, creating dangling pointers when fragments are processed across separate KVM_RUN calls, especially when different tasks handle subsequent runs. EPSS exploitation probability is very low (0.02%, 5th percentile), and vendor patches are available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. No active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel q6apm audio driver allows local authenticated attackers with low privileges to achieve arbitrary code execution, denial of service, or information disclosure with high impact to confidentiality, integrity, and availability. The flaw affects Qualcomm ASoC q6apm component registration code used in devices like Lenovo 21N2ZC5PUS laptops. Vendor-released patches are available across multiple kernel version branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low probability of mass exploitation despite high CVSS 7.8, with no confirmed active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel blk-cgroup subsystem allows local authenticated users to potentially execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in cgwb_release_workfn() when releasing cgroup writeback structures, where a CSS reference is dropped before subsequent dereference, creating a race condition. Meta reports sporadic crashes in production across multiple kernel versions. Patches available for stable branches 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low widespread exploitation probability, and no active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel MediaTek video encoder allows local authenticated users to corrupt memory and potentially execute arbitrary code. The flaw affects the vcodec driver's encoder release path where ctx memory is freed before canceling scheduled workqueue tasks, enabling race conditions between cleanup and worker threads that may dereference freed memory. KASAN-confirmed exploitation requires local access with low privileges (CVSS AV:L/PR:L). Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates very low probability of automated exploitation, with no public exploit identified at time of analysis.
Local privilege escalation and denial of service in the Linux kernel's em28xx USB media driver arises from a use-after-free (CWE-416) in em28xx_v4l2_open(), which reads dev->v4l2 without holding dev->lock. A local attacker who can open the V4L2 device node during a race with the driver's init error path or teardown can trigger a use-after-free on the embedded video_device (via v4l2_fh_init accessing vdev->ctrl_handler) or a NULL dereference in em28xx_resolution_set(). No public exploit identified at time of analysis, and EPSS is very low (0.02%), consistent with a hard-to-win kernel race requiring physical/local USB device presence.
Local privilege-relevant memory corruption in the Linux kernel's powerz hwmon driver (ChargerLAB POWER-Z USB power monitor) allows a local user to trigger a use-after-free by racing a sysfs read against USB device disconnect, dereferencing a freed URB pointer. The bug affects kernels prior to the stable fixes (7.0.1, 6.19.14, 6.18.24, 6.12.83) and carries CVSS 7.8, but with EPSS at just 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk is low. It is not listed in CISA KEV.
Local privilege escalation via a use-after-free in the Linux kernel's ALSA driver for the TerraTec DMX 6Fire USB audio interface (sound/usb/6fire) lets a local attacker corrupt freed slab memory when the device is disconnected. The flaw is a CVSS 7.8 (CVSS:3.1 AV:L/PR:L) memory-corruption bug with publicly available proof-of-concept code, though EPSS is negligible (0.02%) and it is not on CISA KEV. usb6fire_chip_abort() writes chip->card = NULL after snd_card_free_when_closed() may have already freed the card-owned chip struct, giving an attacker a window to hijack freed kernel memory.
Local privilege escalation and denial of service in the Linux kernel's bcache subsystem stems from a use-after-free of the cached_dev.sb_bio structure; if a cached backing device is stopped while a superblock write is in flight, the freed bio is dereferenced at I/O completion (endio), corrupting kernel memory. Affected systems are those running bcache-backed block devices (observed crashing via librbd/libceph rbd workloads), where a local user with the ability to trigger device teardown during superblock activity can crash the host or potentially corrupt kernel memory. This carries no public exploit identified at time of analysis and an EPSS of just 0.02%, consistent with a hard-to-time race rather than a readily weaponized flaw.
Use-after-free and double-free in the Linux kernel's as102 DVB-T USB media driver (drivers/media/usb/as102) allows a local user to corrupt kernel memory by racing an open() of the device node against an error path in as102_usb_probe(). Because the probe error path frees the as102_dev_t structure immediately after usb_register_dev()/usb_deregister_dev() while a userspace file descriptor may still hold a reference, the later .release() path re-accesses and re-frees that structure. CVSS is 7.8 (local, low-privilege); EPSS is negligible (0.02%), no public exploit is identified, and it is not in CISA KEV.
Local privilege escalation and kernel memory corruption in the Linux kernel's HackRF Software-Defined Radio media (V4L2) driver arises from a use-after-free and double-free in the hackrf_probe() error path. When probe fails after v4l2_device_register() has already exposed the device node, the driver frees the hackrf_dev structure directly with kfree() while an already-open file descriptor still holds a reference, so subsequent ioctl() or close() calls dereference and re-free freed memory. There is no public exploit identified at time of analysis; EPSS is 0.02% (5th percentile) and it is not listed in CISA KEV.
Use-after-free in Linux kernel AMD GPU driver allows local authenticated users to potentially execute arbitrary code, escalate privileges, or cause denial of service. The amdgpu_amdkfd_submit_ib() function in the AMD KFD (Kernel Fusion Driver) prematurely releases a DMA fence reference before waiting on it, creating a race condition where the fence memory may be freed before use. Vendor-released patches are available for multiple stable kernel branches (6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0). EPSS exploitation probability is very low at 0.02% (7th percentile), and no public exploit or active exploitation has been identified at time of analysis.
Use-after-free in Linux kernel futex subsystem allows local authenticated attackers to achieve code execution, privilege escalation, or denial of service via sys_futex_requeue() with mismatched flags. Discovered through automated LLM analysis by Nicholas, this affects kernel versions 6.7 through 6.19.x, with patches available in 6.12.80, 6.18.21, 6.19.11, and 7.0. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation or public POC has been identified. The vulnerability requires local access with low-privilege authenticated user credentials (PR:L), making it a post-compromise escalation vector rather than a remote entry point.
Use-after-free in Linux kernel tracing subsystem allows local authenticated attackers to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when deleting tracing instances with copy_trace_marker enabled, where improper RCU synchronization leaves freed memory accessible. Exploitation requires local access with low privileges to manipulate kernel tracing facilities. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability. Vendor patches available across multiple stable kernel versions (6.18.20, 6.19.10, 7.0).
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Sandbox escape in Google Chrome's DevTools component (versions prior to 147.0.7727.117) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, this is a use-after-free (CWE-416) that serves as the second link in a multi-stage exploit chain rather than a standalone remote code execution. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC records no observed exploitation, so it is a patch-and-move-on desktop browser fix rather than an emergency.
Use-after-free in the Linux kernel's kernel TLS (net/tls) data path lets a local attacker corrupt kernel memory by racing the -EBUSY crypto-backlog error path of tls_do_encryption(). When crypto_aead_encrypt() returns -EBUSY, both the async tls_encrypt_done() callback and the synchronous error path clean up encrypt_pending and the scatterlist, double-decrementing a sentinel so a later sendmsg frees an in-flight tls_rec while a cryptd callback is still pending. Despite an NVD CVSS of 9.8, EPSS is 0.01% and there is no public exploit identified at time of analysis, reflecting the narrow race conditions required.
Use-after-free in Linux kernel CAN raw socket implementation allows local authenticated attackers to corrupt memory and potentially achieve code execution. The vulnerability stems from premature deallocation of percpu uniq storage in raw_release() while raw_rcv() may still access it via deferred RCU callbacks. Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability remains low (0.02%, 5th percentile) with no active exploitation confirmed at time of analysis.
Out-of-bounds memory write in rust-openssl's AES key unwrap function allows attackers who control buffer sizes to corrupt memory via safe API misuse. The aes::unwrap_key() function contains an inverted bounds assertion that accepts undersized output buffers and rejects correctly sized ones, causing the function to write beyond allocated memory by in_.len() - 8 - out.len() bytes. Vendor patch available via GitHub PR #2604 and commit 718d07ff, released in openssl-v0.10.78. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis, but the logic flaw is clearly documented in vendor advisory GHSA-8c75-8mhr-p7r9.
Use-after-free in Linux kernel CXL (Compute Express Link) subsystem allows local authenticated attackers to corrupt memory and potentially execute arbitrary code or cause kernel panics. The flaw occurs in cxl_detach_ep() during device removal when parent port references are freed prematurely, before child operations complete. Affects Linux kernel 6.3 through 7.0-rc5; patched in versions 6.12.80, 6.18.21, 6.19.11, and 7.0. EPSS score of 0.02% indicates low exploitation probability. No active exploitation or public exploit code identified at time of analysis.
Use-after-free in Linux Kernel platform driver core allows local authenticated attackers to achieve high-severity impacts including code execution, privilege escalation, or denial of service. The vulnerability stems from unsafe access to the driver_override field during device probing when the bus match() callback executes without device lock protection. Patches are available across multiple kernel branches (6.12.80, 6.18.21, 6.19.11, 7.0) per vendor commits. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no CISA KEV listing exists, suggesting this remains a theoretical risk rather than actively exploited threat despite the high CVSS 7.8 score.
Signed integer overflow in the Linux kernel's BPF interpreter enables local attackers with low privileges to achieve out-of-bounds memory access and potentially execute arbitrary code. The flaw occurs when the 32-bit signed division/modulo operations handle INT_MIN (0x80000000), causing the abs() macro to trigger undefined behavior that creates a mismatch between the verifier's abstract interpretation and the interpreter's runtime behavior. With an EPSS score of 0.02% and no confirmed active exploitation, the primary risk is to systems where unprivileged users can load BPF programs, though default kernel configurations typically restrict BPF to privileged users. Patches are available across multiple stable kernel branches (6.6.131, 6.12.80, 6.18.21, 6.19.11).
Use-after-free in Linux kernel Bluetooth MGMT subsystem allows local authenticated users to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability stems from improper condition checking in mgmt_add_adv_patterns_monitor_complete(), which can leave dangling pointers after freeing memory without unlinking from the list. Patches available across multiple kernel versions (6.12.80, 6.17, 6.18.21, 6.19.11, 7.0). No evidence of active exploitation (not in CISA KEV), low EPSS score (0.02%, 5th percentile) suggests limited attacker interest despite high CVSS severity.
Out-of-bounds memory write in Linux kernel iavf (Intel Adaptive Virtual Function) driver allows local authenticated attackers with low privileges to achieve high confidentiality, integrity, and availability impact via race condition during concurrent ethtool operations. The vulnerability stems from inconsistent use of queue counters (real_num_tx_queues vs num_active_queues vs num_tx_queues) across ethtool statistics functions, enabling memory corruption when changing network channels via 'ethtool -L' while simultaneously querying statistics with 'ethtool -S'. Patches available for kernel versions 6.12.80, 6.18.21, 6.19.11, and 7.0. EPSS exploitation probability is low (0.02%, 5th percentile) with no public exploit or active exploitation identified at time of analysis.
Buffer overflow in Linux kernel's AMD CCP (Cryptographic Coprocessor) driver leaks kernel memory to userspace when retrieving PEK CSR (Platform Endorsement Key Certificate Signing Request). Affecting Linux kernel 4.16+ through 7.0.x, the vulnerability allows local authenticated users to read arbitrary kernel memory due to improper error handling when firmware returns invalid buffer length requirements. Patches available across stable branches (6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1-rc1). EPSS score of 0.02% indicates minimal observed exploitation probability, though the CVSS 7.1 reflects significant confidentiality impact. No CISA KEV listing or public exploit identified at time of analysis.
Information disclosure in Linux kernel's AMD Cryptographic Coprocessor (CCP) driver allows local authenticated attackers to leak kernel memory to userspace via out-of-bounds read. When retrieving PDH certificates through SEV ioctl, the driver incorrectly copies data to userspace even after firmware command failures, potentially reading 2084+ bytes beyond allocated buffer boundaries. EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation probability. Vendor patches available across multiple stable kernel branches (6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1-rc1) per upstream commits.
Buffer overflow in Linux kernel CCP SEV driver allows local authenticated users to leak kernel memory to userspace. When the PSP firmware command to retrieve SEV CPU ID fails due to insufficient buffer size, the driver attempts to copy data beyond the allocated kernel buffer boundary, exposing up to 64 bytes of kernel memory. Exploitation requires local access with low privileges (CVSS PR:L) to invoke the SEV ioctl interface. EPSS score is very low (0.02%, 5th percentile) indicating minimal real-world exploitation observed. No public exploit identified at time of analysis, though the KASAN stack trace in the CVE description provides a clear exploitation path. Patches available across multiple stable kernel branches (6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1-rc1).
Buffer overflow in Linux kernel rxrpc subsystem allows local authenticated users to trigger memory corruption via malformed key payloads. The non-XDR parsing path in rxrpc_preparse() fails to validate ticket length against AFSTOKEN_RK_TIX_MAX, enabling unprivileged users to supply oversized tickets that cause WARN_ON() triggers and potential memory corruption when keys are read. Vendor patches available for kernel versions 6.6.136, 6.12.84, 6.18.25, 7.0.2, and 7.1-rc1. EPSS score of 0.02% indicates low observed exploitation probability, with no public exploit identified at time of analysis.
Use-after-free in Linux kernel virt_wifi driver allows local authenticated users to trigger memory corruption during ethtool operations on virtual WiFi devices being unregistered. The vulnerability stems from improper device parent reference handling via SET_NETDEV_DEV, where ethnl_ops_begin() calls pm_runtime_get_sync() on already-freed memory when a virt_wifi device unregisters concurrently with ethtool operations. Patches are available across multiple stable kernel branches (5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit identified at time of analysis, though CVSS 7.8 reflects potential for complete system compromise if successfully triggered.
Use-after-free in Linux kernel's MANA network driver allows local authenticated attackers to corrupt memory and potentially execute code with kernel privileges. The flaw occurs when auxiliary_device_add() fails in add_adev(), triggering cleanup that frees memory still referenced by subsequent error-handling code. Patches available across stable kernel branches (6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis.
Race condition in Linux kernel ATM LEC driver allows local attackers with low privileges to trigger use-after-free memory corruption in sock_def_readable(), potentially achieving arbitrary code execution, privilege escalation, or denial of service. The flaw affects systems using ATM (Asynchronous Transfer Mode) LAN Emulation Client functionality, present since Linux kernel version 2.4 (commit 1da177e4c3f4). EPSS score of 0.02% (7th percentile) suggests low probability of mass exploitation. Vendor patches available across all maintained stable branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). Not listed in CISA KEV; no public exploit code identified at time of analysis.
Use-after-free in Linux kernel HID subsystem allows local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service when force feedback initialization fails on Logitech G920 racing wheels. The vulnerability occurs when userspace continues accessing freed memory structures (sysfs and /dev/input) after initialization errors. Vendor patches available across multiple stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates very low probability of mass exploitation, consistent with hardware-specific local attack surface requiring physical device presence.
Out-of-bounds memory writes in Linux kernel HID multitouch driver allow local authenticated users to achieve code execution or crash systems via malicious USB/HID devices. The vulnerability exists in the HID multitouch report parsing logic where mismatched report IDs in feature requests can confuse the HID core. Vendor-released patches are available across multiple kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score is low (0.02%, 7th percentile), indicating minimal observed exploitation attempts. No public exploit code identified at time of analysis.
Memory corruption in Linux kernel IPv6 ICMP error handling allows remote unauthenticated attackers to potentially achieve code execution or information disclosure. The vulnerability arises from incomplete control block (CB) sanitization when converting IPv4 ICMP errors to ICMPv6, enabling forged CIPSO options in outer IPv4 packets to manipulate inner IPv6 packet parsing. This can trigger out-of-bounds memory access extending into skb_shared_info structures. Despite CVSS 9.8 critical rating, EPSS exploitation probability is extremely low (0.02%, 7th percentile), no public exploit code exists, and CISA has not listed this as actively exploited. Patches are available across all supported kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0).
A stack-based buffer overflow in the Linux kernel's IPv6-to-IPv4 tunneling (ip6_tunnel) code allows remote unauthenticated attackers to achieve arbitrary code execution. The vulnerability occurs when ip4ip6_err() passes a cloned skb with IPv6-formatted control buffer data to icmp_send(), which misinterprets it as IPv4 control buffer data. This type confusion causes __ip_options_echo() to read attacker-controlled packet data as a length value and copy up to that many bytes into a fixed 40-byte stack buffer, enabling remote exploitation with no prerequisites. EPSS score of 0.02% suggests limited exploitation probability despite critical CVSS 9.8 rating. Vendor-released patches are available across all maintained kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0).
Use-after-free in Linux kernel netfilter subsystem allows local authenticated attackers to corrupt memory and potentially execute arbitrary code with kernel privileges. The vulnerability occurs when unregistering connection tracking helpers - expectations referencing the helper survive cleanup and later dereference the freed helper object during expectation dumps or new connection establishment. Vendor-released patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% indicates low observed exploitation probability; no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.
Stack buffer overflow in Linux kernel Bluetooth MGMT subsystem allows local authenticated attackers to execute arbitrary code with elevated privileges. The vulnerability stems from insufficient validation of the encryption key size (enc_size) parameter when loading Long Term Keys (LTKs) via the Bluetooth management interface. When processing LE LTK requests, the kernel uses the attacker-controlled enc_size value to perform stack operations against a fixed 16-byte buffer, enabling stack corruption through oversized values. Vendor-released patches are available across all active kernel branches. EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit has been identified at time of analysis, though the attack complexity is low once local authenticated access is obtained.
Use-after-free in Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve arbitrary code execution with high privileges. The vulnerability exists in set_cig_params_sync where hci_conn objects can be freed or modified concurrently during lookup and field access due to inadequate locking. Vendor patches are available across multiple stable kernel branches (6.6, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% indicates low observed exploitation probability, no CISA KEV listing, and no public exploit identified at time of analysis.
Use-after-free in Linux Kernel Bluetooth stack allows adjacent network attackers to execute arbitrary code, escalate privileges, or cause denial of service without authentication. The vulnerability exists in hci_le_remote_conn_param_req_evt where hci_conn lookup and field access occurs outside the hdev lock protection, enabling concurrent memory corruption. Patches are available across multiple stable kernel branches (6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0). EPSS score of 0.02% indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in Linux kernel's BPF sockmap implementation allows local authenticated attackers to corrupt memory and potentially execute arbitrary code with kernel privileges. The vulnerability occurs in sk_psock_verdict_data_ready() when handling AF_UNIX sockets, where sk->sk_socket can be accessed after being freed following sock_orphan(). This affects Linux kernel versions 5.15 through 6.19.12, with patches available for stable branches 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0. EPSS score of 0.02% indicates very low observed exploitation probability in the wild, and no active exploitation or public exploit code has been identified at time of analysis.
Use-after-free in Linux kernel macb driver allows local authenticated attackers to cause denial of service or potentially escalate privileges during module removal. The vulnerability occurs in the PCI glue driver when platform_device_unregister() triggers a runtime resume callback that attempts to access already-freed clock structures. EPSS score is low (0.02%) with no evidence of active exploitation. Vendor patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0).
A heap buffer overflow in the Linux kernel's wilc1000 WiFi driver allows local authenticated users to trigger memory corruption via crafted SSID scan requests. The driver miscalculates buffer size due to u8 integer overflow (330 bytes wrapping to 74), causing kmalloc to allocate 75 bytes while memcpy writes up to 331 bytes - a 256-byte overflow. Patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.03% (9th percentile) suggests low likelihood of widespread exploitation, and CISA KEV does not list this CVE, indicating no confirmed active exploitation at time of analysis.
Stack buffer overflow in Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve code execution, privilege escalation, or denial of service through malformed ISO socket parameters. The vulnerability occurs when binding an ISO Bluetooth socket with up to 31 BIS entries while the hci_le_big_create_sync() function only allocates stack space for 17 entries, resulting in a 14-byte overflow that corrupts adjacent stack memory. Patches are available across multiple kernel versions (6.12.81, 6.18.22, 6.19.12, 7.0), with EPSS indicating 0.02% exploitation probability and no active exploitation confirmed.
Use-after-free in Linux kernel GPIB subsystem allows local authenticated attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers when concurrent IBCLOSEDEV calls free descriptors still in use by I/O operations. EPSS probability is very low (0.02%, 4th percentile), indicating minimal observed exploitation activity. Vendor patches available for stable branches 6.18.22, 6.19.12, and mainline 7.0 via commits cae26eff, 28c75dd1, and d1857f82.
Use-after-free condition in Linux kernel USB Test and Measurement Class (USBTMC) driver allows local authenticated attackers to execute arbitrary code with elevated privileges. The vulnerability occurs when the usbtmc_release function fails to properly flush pending anchored URBs, leaving dangling references that can be exploited in the HCD giveback path. Vendor patches are available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0). Despite the high CVSS score of 7.8, the EPSS exploitation probability is very low at 0.02% (7th percentile), indicating limited real-world targeting, and no active exploitation or public POC has been identified.
Buffer overflow in Linux kernel COMEDI me_daq driver allows local authenticated users to achieve arbitrary code execution with kernel privileges. The me2600_xilinx_download() function fails to validate firmware file length before reading data streams, enabling out-of-bounds memory access during firmware loading operations. Patches available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates low probability of widespread exploitation despite high CVSS 7.8 rating, and no active exploitation or public exploit code identified at time of analysis.
Out-of-bounds write in Linux kernel comedi me4000 driver firmware loader allows local authenticated users to achieve high-impact code execution, data corruption, or system crash. The me4000_xilinx_download() function blindly trusts firmware file format headers without validating buffer boundaries, reading a length field from the first 4 bytes and then reading that many bytes from offset 16 without checking total file size. Patch available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability despite CVSS 7.8 rating. No public exploit code or active exploitation confirmed.
Memory corruption in the Linux kernel zynqmp_nvmem driver allows local authenticated users to achieve privilege escalation through undersized DMA buffer exploitation. The vulnerability stems from incorrect buffer size calculations in dma_alloc_coherent and memcpy operations, enabling heap or memory corruption that can lead to complete system compromise. With a 7.8 CVSS score but only 0.02% EPSS (5th percentile), this represents a high-severity issue affecting specific Xilinx Zynq UltraScale+ deployments rather than a widespread exploitation target. Patches available across multiple stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0) with upstream fixes confirmed in git commits.
Use-after-free in Linux kernel thermal subsystem allows local attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability stems from race conditions between thermal zone removal and power management resume operations, where delayed work items can continue executing after thermal zone objects are freed. EPSS score of 0.02% (5th percentile) suggests low probability of mass exploitation despite high CVSS severity. Vendor patches available across multiple stable kernel branches (6.12.83, 6.18.22, 6.19.12, 7.0) via upstream commits. No active exploitation confirmed in CISA KEV at time of analysis.
Local privilege escalation via stack out-of-bounds write affects the f_uac1_legacy USB Audio Class 1.0 gadget driver in the Linux kernel, where f_audio_complete() memcpy's a host-controlled req->length into a fixed 4-byte stack variable without validation. A device operating in USB gadget/peripheral mode can be driven by a malicious or crafted USB host to corrupt kernel stack memory, yielding CVSS 7.8 (High) with full confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and EPSS is negligible (0.02%), but the flaw is upstream-patched across many stable trees.
Remote denial of service in FRRouting stable/10.0 allows unauthenticated attackers to crash the BGP daemon via malformed FlowSpec NLRI messages. The off-by-one vulnerability in bgp_flowspec_op_decode() enables out-of-bounds writes when parsing crafted BGP FlowSpec components, causing process termination. EPSS exploitation probability data not available, but SSVC marks this as automatable with partial technical impact. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting theoretical rather than actively exploited risk.
Buffer overflow in Linux kernel Xen hypervisor interface allows local authenticated users to achieve arbitrary code execution with high privilege escalation impact. The vulnerability stems from improper handling of non-NUL-terminated build ID data from HYPERVISOR_xen_version(XENVER_build_id) in drivers/xen/sys-hypervisor.c, where sprintf reads past buffer boundaries seeking a NUL terminator. Affects Linux kernel versions from 5.10 through 7.0 series when running as Xen domain. Vendor-released patches available across all affected stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3). EPSS score of 0.08% (23rd percentile) indicates low probability of mass exploitation despite high CVSS 7.8, reflecting specialized Xen-only attack surface. No public exploit identified at time of analysis.
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
Renderer-level arbitrary code execution in Google Chrome's Media component affects all desktop builds prior to 147.0.7727.138, where a use-after-free (CWE-416) lets a remote attacker run code inside the browser sandbox when a victim loads a crafted HTML page. Google's own Chrome team reported it and Chromium rated it Medium severity because execution is confined to the sandboxed renderer rather than the host. There is no public exploit identified at time of analysis, and EPSS is very low at 0.04% (11th percentile), so no confirmed active exploitation exists.
Sandboxed remote code execution in Google Chrome's WebRTC component affects all desktop builds prior to 147.0.7727.138, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code within the renderer sandbox. Google rates the Chromium severity as High and has shipped a fix in the Stable channel; there is no public exploit identified at time of analysis and the EPSS probability is negligible (0.01%). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and code execution is confined to the sandbox unless chained with a separate sandbox-escape bug.
Sandboxed arbitrary code execution in Google Chrome for Android (WebView component) before 147.0.7727.138 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is very low (0.03%). Exploitation requires user interaction (visiting attacker content) and, per the description, execution is contained inside the sandbox rather than achieving a full sandbox escape.
Heap corruption in Google Chrome's Cast component (versions prior to 147.0.7727.138) allows an attacker positioned on the same local network segment to trigger a use-after-free via malicious network traffic, potentially leading to code execution within the browser process. The flaw was reported internally by the Chrome team and carries a High Chromium severity, but there is no public exploit identified at time of analysis and EPSS scores exploitation probability at effectively 0%. It is not listed in CISA KEV, and CISA's SSVC assessment marks exploitation as none and the attack as not automatable.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects all desktop versions prior to 147.0.7727.138, where a use-after-free flaw lets a remote attacker corrupt memory and run arbitrary code by sending malicious network traffic to an active remote-desktop session. Google rates it High severity; there is no public exploit identified at time of analysis and it is not in CISA KEV, with an EPSS probability of only 0.01% (2nd percentile). A vendor patch is available, and SSVC scores exploitation as none but technical impact as total.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a type confusion condition rated High severity by Chromium; there is no public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), and SSVC records no observed exploitation, though the technical impact is total. A vendor patch is available.
Remote code execution in Google Chrome's WebRTC component (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free memory corruption reported by Google's own Chrome team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none', indicating no observed exploitation despite the high technical severity.
Remote code execution in Google Chrome desktop before 147.0.7727.138 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the media component. Google rates the Chromium severity High and has shipped a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile). Notably the description confines code execution to inside the sandbox, so a separate sandbox-escape bug would be required for full host compromise.
Remote code execution in Google Chrome desktop before 147.0.7727.138 stems from a use-after-free in the browser's Codecs component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code within Chrome's renderer sandbox. Rated High severity by Chromium with CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.01%.
Sandboxed remote code execution in Google Chrome's Cast component affects all desktop builds prior to 147.0.7727.138, where a CWE-416 use-after-free lets an attacker on the same local network segment run arbitrary code inside the Chromium sandbox by sending malicious network traffic. Chromium rates the flaw High severity, but SSVC records no observed exploitation and EPSS is 0.00%, and no public exploit has been identified at time of analysis. Google has shipped a fixed Stable channel build.
Sandbox escape in Google Chrome's WebMIDI component (versions prior to 147.0.7727.138) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and carrying a CVSS of 8.3 with a scope-change (S:C) impact, it is a use-after-free (CWE-416) that Google has patched in the Stable channel. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
Sandbox escape in Google Chrome for Android (Media component) prior to 147.0.7727.138 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Chromium rates the severity High and a vendor patch is available; no public exploit is identified, EPSS is very low (0.01%, 1st percentile), and SSVC records exploitation status 'none'. It is a second-stage escape rather than an initial-access primitive, so it must be chained with a prior renderer compromise to have real impact.
Remote code execution in Google Chrome desktop builds prior to 147.0.7727.138 arises from a use-after-free in the Navigation component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer context. Chromium rates the flaw High severity and CVSS scores it 8.8, but there is no public exploit identified at time of analysis and EPSS is very low at 0.04% (11th percentile). A vendor patch is available and CISA's SSVC framework currently records exploitation as none.
Heap corruption in the GPU component of Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process escalate impact via a use-after-free triggered by a crafted HTML page. This is a High-severity Chromium memory-corruption bug reported internally by Chrome, with a vendor patch shipped in the April 2026 stable channel update and no public exploit identified at time of analysis. EPSS is minimal (0.01%) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Heap corruption in the Views UI component of Google Chrome on macOS (versions prior to 147.0.7727.138) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution. Rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC lists exploitation as none.
Remote code execution in Google Chrome desktop before 147.0.7727.138 arises from a use-after-free in the Animation component (CWE-416), allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though execution is constrained to inside the renderer sandbox. Chromium rates the severity High and a vendor patch is available; there is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC marks exploitation as none.
Sandbox escape in Google Chrome's ANGLE graphics abstraction layer (versions prior to 147.0.7727.138) lets an attacker who already controls a compromised renderer process break out of the browser sandbox by loading a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, it is a use-after-free (CWE-416) memory-corruption bug used as the second stage of a browser exploit chain. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA's SSVC framework records exploitation status as none.
Sandbox escape in Google Chrome's GPU process prior to 147.0.7727.138 lets a remote attacker corrupt memory via a use-after-free when a victim visits a crafted HTML page, potentially breaking out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to the scope change (S:C) inherent to a sandbox escape, though it requires user interaction (visiting a page). There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not on CISA KEV.
Sandbox escape in Google Chrome for Windows (versions prior to 147.0.7727.138) stems from a use-after-free in the Views UI component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader code execution on the host via a crafted HTML page. Chromium rates the internal severity as Critical, though the assigned CVSS is 7.5 due to the high attack complexity and the renderer-compromise prerequisite. This is a second-stage bug: there is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome on Windows (versions prior to 147.0.7727.138) leverages a use-after-free flaw in the browser's Accessibility component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain higher-privileged code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.8, the bug is patched but has no public exploit identified at time of analysis, and its EPSS score is very low (0.01%). This is a second-stage primitive typically chained with a separate renderer-RCE bug rather than exploited in isolation.
Heap corruption via use-after-free in Google Chrome (iOS) before 147.0.7727.138 allows a remote attacker to potentially execute code or crash the browser when a victim opens a crafted HTML page. Chromium rates the flaw Critical severity, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.01%). Exploitation requires the victim to load attacker-controlled web content (UI:R).
Remote code execution in Google Chrome (Canvas component) on Linux and ChromeOS before 147.0.7727.138 lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated Critical by Chromium, the flaw is a Canvas use-after-free (CWE-416); code execution is confined to the sandboxed renderer rather than the host OS. No public exploit identified at time of analysis and EPSS is very low (0.01%), though SSVC rates technical impact as total and the attack as automatable.
Memory corruption in Mozilla Firefox 150.0.0, Firefox ESR 140.10.0, Thunderbird 150.0.0 and Thunderbird ESR 140.10.0 stems from an out-of-bounds write (CWE-787) that Mozilla assessed as potentially exploitable for arbitrary code execution. Mozilla's own engineers discovered the bugs through internal fuzzing/auditing and shipped fixes in Firefox 150.0.1 and Firefox ESR 140.10.1; there is no public exploit identified at time of analysis and EPSS is very low (0.04%). The flaw affects the browser/mail-client rendering engine, so a victim who loads attacker-controlled web content is the realistic trigger despite the raw CVSS vector.
Out-of-bounds write in GNU C Library 2.2+ allows remote unauthenticated attackers to corrupt memory and potentially execute arbitrary code through specially crafted TSIG DNS records processed by deprecated ns_printrrf, ns_printrr, or fp_nquery functions. While these functions are deprecated, any application still using them for DNS record printing remains vulnerable to network-based attacks with low complexity and no authentication barriers. No public exploit identified at time of analysis, but the deprecated status suggests limited real-world exposure despite the network attack vector.
Buffer overflow in TH1520 AON firmware protocol driver allows local authenticated attackers with low privileges to execute arbitrary code and gain elevated system access. The vulnerability stems from unsafe pointer arithmetic when accessing the 'mode' field through the 'resource' pointer with unchecked offsets in the T-HEAD firmware driver. Patches available across stable kernel branches (6.18.23, 6.19.13, 7.0) with low EPSS score (0.02%) indicating minimal observed exploitation attempts, though CVSS 7.8 reflects high impact if exploited on affected T-HEAD TH1520 systems.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to corrupt memory and potentially disclose sensitive information through out-of-range writes when applications use v3, v5, or v6 UUID generation functions with caller-provided output buffers. The library fails to validate buffer boundaries, allowing partial writes beyond allocated memory regions. Vendor patch available in version 14.0.0 per GitHub security advisory GHSA-w5hq-g745-h8pq. No confirmed active exploitation (not in CISA KEV), and CVSS 4.0 Environmental Score suggests exploitation status is unproven (E:U).
Kernel memory corruption in Linux's MPTCP subsystem allows a use-after-free in __inet_lookup_established affecting IPv6 subflow sockets. Because mptcp_subflow_init() copied tcpv6_prot before inet6_init() had registered its slab cache, MPTCP IPv6 child sockets were allocated from kmalloc-4k without the SLAB_TYPESAFE_BY_RCU guarantee, so lockless RCU ehash lookups could dereference freed socket memory. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the flaw is remotely reachable via network traffic on hosts using MPTCP over IPv6.
Local privilege escalation and memory corruption in the Linux kernel's netfilter nf_tables conntrack (nft_ct) subsystem allows a local user with network-admin capability to trigger a use-after-free by destroying a conntrack timeout object while packets on other CPUs still reference it. The flaw stems from nft_ct_timeout_obj_destroy() calling kfree() immediately after nf_ct_untimeout() without waiting for an RCU grace period, leaving a dangling RCU-protected pointer read during nf_conntrack_tcp_packet(). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a KASAN reproducer ('exploit' task) is described in the commit and the bug is a classic exploitable CWE-416 heap UAF.
Memory leak (with latent use-after-free risk) in the Linux kernel's DAMON monitoring subsystem (mm/damon/stat) allows a local, privileged user to leak damon_ctx objects and potentially trigger use-after-free by repeatedly toggling the DAMON_STAT 'enabled' control after a damon_call() failure. Affected are kernels on the 6.17-6.19 line prior to the stable fixes; the flaw is classified CWE-416 (Use After Free). There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 4th percentile).
Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.
Use-after-free in Linux kernel's lan966x network driver allows local authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The flaw occurs in lan966x_fdma_reload() when RX buffer allocation fails - freed pages remain referenced by active DMA descriptors, causing hardware to write into memory now controlled by other kernel subsystems. Vendor patches available for stable branches 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis, but successful exploitation grants kernel-level privileges to local attackers.
Buffer overread in Linux kernel's rxgk_do_verify_authenticator() function allows remote unauthenticated attackers to trigger information disclosure and high-availability denial of service through network-accessible RxGK authentication handling. The vulnerability stems from improper buffer size validation before nonce verification in the RxRPC subsystem. Patches are available from the Linux kernel stable tree (versions 6.19.13, 6.18.23, and 7.0). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability, and no active exploitation or public POC has been identified. Despite the high CVSS base score of 8.2, real-world risk appears limited to environments using RxRPC with RxGK authentication.
Heap buffer overflow in Linux kernel USB/IP client allows malicious USB/IP servers to execute arbitrary code with kernel privileges via crafted RET_SUBMIT responses. A rogue server can specify a larger number_of_packets value than originally submitted, causing out-of-bounds writes when processing isochronous USB transfers. Patched in kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) suggests low probability of widespread exploitation despite CVSS 9.8 criticality, indicating this is primarily a risk in environments using USB/IP with untrusted servers rather than a general internet-facing threat.
Use-after-free in Linux kernel OCFS2 filesystem enables local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when filemap_fault() drops mmap_lock before returning VM_FAULT_RETRY, allowing concurrent munmap() to free the vm_area_struct while ocfs2_fault() still holds a dangling pointer. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis.
Use-after-free in Linux kernel memory management allows remote code execution when the folio_unmap_invalidate() function incorrectly accesses freed mapping structures. Kernel versions between 1da177e4c3f4 and patches 6.19.14/7.0.1 are affected. Exploitation probability is low (EPSS 2%, percentile 5%), with no confirmed active exploitation or public POC at time of analysis. Despite the critical CVSS 9.8 score indicating network-based unauthenticated attack, the description suggests this is a kernel memory corruption bug requiring local kernel code paths to trigger, not direct remote network exploitation - CVSS vector conflicts with technical nature and should be validated against vendor guidance.
Use-after-free in Linux kernel KVM x86 MMIO emulation allows local authenticated users with low privileges to potentially execute arbitrary code, escalate privileges, or cause denial of service. The flaw occurs when KVM's emulator initiates MMIO writes using on-stack variables that cross page boundaries between two MMIO pages, creating dangling pointers when fragments are processed across separate KVM_RUN calls, especially when different tasks handle subsequent runs. EPSS exploitation probability is very low (0.02%, 5th percentile), and vendor patches are available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. No active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel q6apm audio driver allows local authenticated attackers with low privileges to achieve arbitrary code execution, denial of service, or information disclosure with high impact to confidentiality, integrity, and availability. The flaw affects Qualcomm ASoC q6apm component registration code used in devices like Lenovo 21N2ZC5PUS laptops. Vendor-released patches are available across multiple kernel version branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low probability of mass exploitation despite high CVSS 7.8, with no confirmed active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel blk-cgroup subsystem allows local authenticated users to potentially execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in cgwb_release_workfn() when releasing cgroup writeback structures, where a CSS reference is dropped before subsequent dereference, creating a race condition. Meta reports sporadic crashes in production across multiple kernel versions. Patches available for stable branches 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low widespread exploitation probability, and no active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel MediaTek video encoder allows local authenticated users to corrupt memory and potentially execute arbitrary code. The flaw affects the vcodec driver's encoder release path where ctx memory is freed before canceling scheduled workqueue tasks, enabling race conditions between cleanup and worker threads that may dereference freed memory. KASAN-confirmed exploitation requires local access with low privileges (CVSS AV:L/PR:L). Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates very low probability of automated exploitation, with no public exploit identified at time of analysis.
Local privilege escalation and denial of service in the Linux kernel's em28xx USB media driver arises from a use-after-free (CWE-416) in em28xx_v4l2_open(), which reads dev->v4l2 without holding dev->lock. A local attacker who can open the V4L2 device node during a race with the driver's init error path or teardown can trigger a use-after-free on the embedded video_device (via v4l2_fh_init accessing vdev->ctrl_handler) or a NULL dereference in em28xx_resolution_set(). No public exploit identified at time of analysis, and EPSS is very low (0.02%), consistent with a hard-to-win kernel race requiring physical/local USB device presence.
Local privilege-relevant memory corruption in the Linux kernel's powerz hwmon driver (ChargerLAB POWER-Z USB power monitor) allows a local user to trigger a use-after-free by racing a sysfs read against USB device disconnect, dereferencing a freed URB pointer. The bug affects kernels prior to the stable fixes (7.0.1, 6.19.14, 6.18.24, 6.12.83) and carries CVSS 7.8, but with EPSS at just 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk is low. It is not listed in CISA KEV.
Local privilege escalation via a use-after-free in the Linux kernel's ALSA driver for the TerraTec DMX 6Fire USB audio interface (sound/usb/6fire) lets a local attacker corrupt freed slab memory when the device is disconnected. The flaw is a CVSS 7.8 (CVSS:3.1 AV:L/PR:L) memory-corruption bug with publicly available proof-of-concept code, though EPSS is negligible (0.02%) and it is not on CISA KEV. usb6fire_chip_abort() writes chip->card = NULL after snd_card_free_when_closed() may have already freed the card-owned chip struct, giving an attacker a window to hijack freed kernel memory.
Local privilege escalation and denial of service in the Linux kernel's bcache subsystem stems from a use-after-free of the cached_dev.sb_bio structure; if a cached backing device is stopped while a superblock write is in flight, the freed bio is dereferenced at I/O completion (endio), corrupting kernel memory. Affected systems are those running bcache-backed block devices (observed crashing via librbd/libceph rbd workloads), where a local user with the ability to trigger device teardown during superblock activity can crash the host or potentially corrupt kernel memory. This carries no public exploit identified at time of analysis and an EPSS of just 0.02%, consistent with a hard-to-time race rather than a readily weaponized flaw.
Use-after-free and double-free in the Linux kernel's as102 DVB-T USB media driver (drivers/media/usb/as102) allows a local user to corrupt kernel memory by racing an open() of the device node against an error path in as102_usb_probe(). Because the probe error path frees the as102_dev_t structure immediately after usb_register_dev()/usb_deregister_dev() while a userspace file descriptor may still hold a reference, the later .release() path re-accesses and re-frees that structure. CVSS is 7.8 (local, low-privilege); EPSS is negligible (0.02%), no public exploit is identified, and it is not in CISA KEV.
Local privilege escalation and kernel memory corruption in the Linux kernel's HackRF Software-Defined Radio media (V4L2) driver arises from a use-after-free and double-free in the hackrf_probe() error path. When probe fails after v4l2_device_register() has already exposed the device node, the driver frees the hackrf_dev structure directly with kfree() while an already-open file descriptor still holds a reference, so subsequent ioctl() or close() calls dereference and re-free freed memory. There is no public exploit identified at time of analysis; EPSS is 0.02% (5th percentile) and it is not listed in CISA KEV.
Use-after-free in Linux kernel AMD GPU driver allows local authenticated users to potentially execute arbitrary code, escalate privileges, or cause denial of service. The amdgpu_amdkfd_submit_ib() function in the AMD KFD (Kernel Fusion Driver) prematurely releases a DMA fence reference before waiting on it, creating a race condition where the fence memory may be freed before use. Vendor-released patches are available for multiple stable kernel branches (6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0). EPSS exploitation probability is very low at 0.02% (7th percentile), and no public exploit or active exploitation has been identified at time of analysis.
Use-after-free in Linux kernel futex subsystem allows local authenticated attackers to achieve code execution, privilege escalation, or denial of service via sys_futex_requeue() with mismatched flags. Discovered through automated LLM analysis by Nicholas, this affects kernel versions 6.7 through 6.19.x, with patches available in 6.12.80, 6.18.21, 6.19.11, and 7.0. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation or public POC has been identified. The vulnerability requires local access with low-privilege authenticated user credentials (PR:L), making it a post-compromise escalation vector rather than a remote entry point.
Use-after-free in Linux kernel tracing subsystem allows local authenticated attackers to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when deleting tracing instances with copy_trace_marker enabled, where improper RCU synchronization leaves freed memory accessible. Exploitation requires local access with low privileges to manipulate kernel tracing facilities. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability. Vendor patches available across multiple stable kernel versions (6.18.20, 6.19.10, 7.0).
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Sandbox escape in Google Chrome's DevTools component (versions prior to 147.0.7727.117) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, this is a use-after-free (CWE-416) that serves as the second link in a multi-stage exploit chain rather than a standalone remote code execution. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC records no observed exploitation, so it is a patch-and-move-on desktop browser fix rather than an emergency.
Use-after-free in the Linux kernel's kernel TLS (net/tls) data path lets a local attacker corrupt kernel memory by racing the -EBUSY crypto-backlog error path of tls_do_encryption(). When crypto_aead_encrypt() returns -EBUSY, both the async tls_encrypt_done() callback and the synchronous error path clean up encrypt_pending and the scatterlist, double-decrementing a sentinel so a later sendmsg frees an in-flight tls_rec while a cryptd callback is still pending. Despite an NVD CVSS of 9.8, EPSS is 0.01% and there is no public exploit identified at time of analysis, reflecting the narrow race conditions required.
Use-after-free in Linux kernel CAN raw socket implementation allows local authenticated attackers to corrupt memory and potentially achieve code execution. The vulnerability stems from premature deallocation of percpu uniq storage in raw_release() while raw_rcv() may still access it via deferred RCU callbacks. Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability remains low (0.02%, 5th percentile) with no active exploitation confirmed at time of analysis.
Out-of-bounds memory write in rust-openssl's AES key unwrap function allows attackers who control buffer sizes to corrupt memory via safe API misuse. The aes::unwrap_key() function contains an inverted bounds assertion that accepts undersized output buffers and rejects correctly sized ones, causing the function to write beyond allocated memory by in_.len() - 8 - out.len() bytes. Vendor patch available via GitHub PR #2604 and commit 718d07ff, released in openssl-v0.10.78. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis, but the logic flaw is clearly documented in vendor advisory GHSA-8c75-8mhr-p7r9.
Use-after-free in Linux kernel CXL (Compute Express Link) subsystem allows local authenticated attackers to corrupt memory and potentially execute arbitrary code or cause kernel panics. The flaw occurs in cxl_detach_ep() during device removal when parent port references are freed prematurely, before child operations complete. Affects Linux kernel 6.3 through 7.0-rc5; patched in versions 6.12.80, 6.18.21, 6.19.11, and 7.0. EPSS score of 0.02% indicates low exploitation probability. No active exploitation or public exploit code identified at time of analysis.
Use-after-free in Linux Kernel platform driver core allows local authenticated attackers to achieve high-severity impacts including code execution, privilege escalation, or denial of service. The vulnerability stems from unsafe access to the driver_override field during device probing when the bus match() callback executes without device lock protection. Patches are available across multiple kernel branches (6.12.80, 6.18.21, 6.19.11, 7.0) per vendor commits. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no CISA KEV listing exists, suggesting this remains a theoretical risk rather than actively exploited threat despite the high CVSS 7.8 score.
Signed integer overflow in the Linux kernel's BPF interpreter enables local attackers with low privileges to achieve out-of-bounds memory access and potentially execute arbitrary code. The flaw occurs when the 32-bit signed division/modulo operations handle INT_MIN (0x80000000), causing the abs() macro to trigger undefined behavior that creates a mismatch between the verifier's abstract interpretation and the interpreter's runtime behavior. With an EPSS score of 0.02% and no confirmed active exploitation, the primary risk is to systems where unprivileged users can load BPF programs, though default kernel configurations typically restrict BPF to privileged users. Patches are available across multiple stable kernel branches (6.6.131, 6.12.80, 6.18.21, 6.19.11).
Use-after-free in Linux kernel Bluetooth MGMT subsystem allows local authenticated users to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability stems from improper condition checking in mgmt_add_adv_patterns_monitor_complete(), which can leave dangling pointers after freeing memory without unlinking from the list. Patches available across multiple kernel versions (6.12.80, 6.17, 6.18.21, 6.19.11, 7.0). No evidence of active exploitation (not in CISA KEV), low EPSS score (0.02%, 5th percentile) suggests limited attacker interest despite high CVSS severity.
Out-of-bounds memory write in Linux kernel iavf (Intel Adaptive Virtual Function) driver allows local authenticated attackers with low privileges to achieve high confidentiality, integrity, and availability impact via race condition during concurrent ethtool operations. The vulnerability stems from inconsistent use of queue counters (real_num_tx_queues vs num_active_queues vs num_tx_queues) across ethtool statistics functions, enabling memory corruption when changing network channels via 'ethtool -L' while simultaneously querying statistics with 'ethtool -S'. Patches available for kernel versions 6.12.80, 6.18.21, 6.19.11, and 7.0. EPSS exploitation probability is low (0.02%, 5th percentile) with no public exploit or active exploitation identified at time of analysis.