Memory Corruption
Monthly
Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAPH_RECOMPUTE handler, letting unauthenticated remote attackers gain arbitrary memory read/write and ultimately full RCE on any host exposing the distributed-inference RPC backend. An attacker stores a computation graph, frees the buffers it references, then reclaims that freed memory with attacker-controlled content before triggering re-execution against the dangling pointers. Reported by VulnCheck and fixed in b8585; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands to GPU Firmware, triggering writes outside the guest's virtualized GPU memory boundary (CWE-823). Affected are multiple DDK release trains including versions 25.1 RTM2 through 25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. No public exploit code exists and CISA has not added this to KEV; however, SSVC assesses total technical impact given successful exploitation yields full C/I/A compromise of the guest environment.
Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated exploitation, and IBM PSIRT has published a support advisory. There is no public exploit identified at time of analysis, EPSS is modest (0.61%, 47th percentile), and CISA SSVC rates exploitation as 'none' with technical impact 'total'.
Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise of the affected Unix host or virtualization I/O server. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.41%, 35th percentile), with CISA SSVC recording no observed exploitation.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger over the network without authentication or user interaction. Per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the flaw is critical (9.8) with total confidentiality, integrity, and availability impact, though the description does not name the specific network service or daemon that parses the malformed input. There is no public exploit identified at time of analysis, and EPSS is low (0.41%, 35th percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.
Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.
Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that lets a remote attacker overwrite memory and run arbitrary code on the host. IBM PSIRT rated it CVSS 9.8, and the vector indicates network-reachable, unauthenticated exploitation requiring no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE on an enterprise Unix platform makes it a high-priority patch.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger without authentication or user interaction, yielding full compromise of the affected system. IBM PSIRT rates it CVSS 9.8, reflecting complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a use-after-free (CWE-416) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 9.8). IBM has released a fix and there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.
Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.
Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local authenticated attacker with high privileges to execute arbitrary code on affected systems. The vulnerability is rooted in improper memory management (CWE-787) and carries a CVSS 3.1 score of 6.7, reflecting the local access requirement and elevated privilege prerequisite that constrain real-world exploitability. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.
Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.
Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.
Out-of-bounds write in Tor's consensus and detached signature parser allows remote, unauthenticated network peers to trigger memory corruption by supplying a document with an unexpected signature digest type. All Tor releases before 0.4.9.9 are affected; impact is minor for relay and client nodes but potentially major for directory authorities, whose compromise could disrupt or undermine the integrity of the network-wide consensus. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-reachable attack vector and scope change in the CVSS vector (S:C) warrant urgent patching for directory authority operators specifically.
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.
Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.
Type confusion in the Lean 4 proof assistant kernel allows a malicious metaprogram to produce a proof of False carrying no axioms, from which any proposition can be derived, completely breaking kernel soundness. The vulnerability arises from two related defects in src/kernel/inductive.cpp: projection expressions do not verify that the named structure matches the projected value's type, and environment::add_inductive fails to type-check the parametric arguments of nested inductive applications after they are replaced by auxiliary types, letting those arguments escape kernel verification entirely - exploitable through the normal maximum-kernel-checking addDecl path without sorry, unsafeCast, or unsafe annotations. Publicly available exploit code exists at multiple repositories; this CVE is not listed in CISA KEV.
Remote code execution in GStreamer's rtpsbcdepay plugin is achieved when a user processes a crafted RTP stream containing malformed SBC audio payload, triggering a use-after-free that corrupts heap memory and redirects execution to attacker-controlled code within the affected process. The flaw exists in all GStreamer installations where the rtpsbcdepay element is exercised, covering a broad surface area including Linux media players, VoIP clients, and Bluetooth audio gateways. No public exploit has been identified at time of analysis, but coordinated disclosure by ZDI (ZDI-CAN-29787) confirms technical reproduction, and a vendor security advisory (SA-2026-0051) has been published.
Remote code execution via malicious MRF media files affects GStreamer across all versions tracked under CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The MRF file parser fails to validate user-supplied input bounds, allowing a heap out-of-bounds write (CWE-787) that corrupts memory and redirects execution to attacker-controlled code within the victim process. Exploitation requires user interaction - opening a crafted file or visiting a page that triggers GStreamer parsing - and no public exploit or CISA KEV listing has been identified at time of analysis, though ZDI coordinated disclosure (ZDI-CAN-29510) and an upstream vendor advisory (sa-2026-0050) are both present.
Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds write in OriginPro's OGG file parsing component enables arbitrary code execution in the context of the current user's process when a crafted OGG file is opened. Affected installations include OriginPro 2026 SR1, as confirmed by ZDI (ZDI-CAN-29333 / ZDI-26-549) and EUVD-2026-63438. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though user interaction is the sole barrier to exploitation once a malicious file is delivered.
Out-of-bounds write in OriginPro's OPJ project file parser enables remote attackers to execute arbitrary code when a user opens a specially crafted OPJ file. The flaw, disclosed by Zero Day Initiative as ZDI-CAN-29332, results from insufficient validation of user-supplied data during file parsing - allowing a write past the end of an allocated data structure and full compromise of the target process. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis, but ZDI coordinated disclosure typically reduces the time-to-exploit development once advisories publish.
Remote code execution is achievable in OriginLab OriginPro through a maliciously crafted OPJU project file, exploiting an out-of-bounds write (CWE-787) in the application's file parser. OriginPro 2026 SR1 is confirmed affected per EUVD-2026-63436, with the CPE string suggesting broader version coverage may apply. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; however, ZDI discovery (ZDI-CAN-29331) indicates coordinated research disclosure, and the low attack complexity once the file is delivered makes this a meaningful risk to research and scientific computing environments.
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbitrary code at root privilege via the tchdr_bytestream_read function. The device - an in-vehicle infotainment/navigation unit - fails to bounds-check user-supplied data during bytestream parsing, resulting in a heap or stack write past the allocated buffer. No public exploit or active CISA KEV listing has been identified at time of analysis, and real-world impact is materially constrained by the physical access prerequisite.
Heap out-of-bounds write in GraphicsMagick's Photo CD (PCD) decoder enables heap memory corruption when processing a maliciously crafted PCD image. The DecodeImage() function in coders/pcd.c unconditionally advances its output pointer (q++) on every decoded Huffman delta without validating it against the end of the heap-allocated luma or chroma plane buffers, so an attacker-controlled PCD file can drive the pointer arbitrarily past the allocation boundary and overwrite adjacent heap memory. Any application invoking gm convert, gm identify, or linking against libGraphicsMagick while processing untrusted PCD files is at risk; no public exploit is identified at time of analysis.
Stack buffer overflow in GNU binutils 2.46.1 and earlier allows arbitrary code execution when a victim opens a crafted PE (Portable Executable) file using any binutils tool such as objdump or readelf. The out-of-bounds stack write (CWE-787) can corrupt return addresses, enabling attacker-controlled code execution in the victim's user context. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.8 High rating reflects full confidentiality, integrity, and availability impact if successfully exploited.
Use-after-free in libexpat before 2.8.4 allows an attacker who can supply crafted XML with a custom unknown-encoding declaration to corrupt parser memory when the encoding convert or release callback re-enters the parser without handler-depth tracking. Affected applications are those that register an UnknownEncodingHandler via XML_SetUnknownEncodingHandler - a non-default but legitimate usage pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.9 with AV:L/AC:H reflects the constrained exploitation prerequisites, though the library's wide deployment footprint elevates aggregate risk.
Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.
Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.
Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets an unauthenticated network attacker run arbitrary code by supplying malicious pointers that the OS fails to validate (CWE-843 type confusion). The flaw carries a critical CVSS 9.8 and was disclosed by IBM PSIRT with no user interaction required, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because AIX/VIOS underpins production IBM Power server estates, a working exploit would give attackers full compromise of the affected operating system.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local, high-privileged attacker to execute arbitrary code. The vulnerability is rooted in a memory corruption flaw (CWE-787) that can corrupt adjacent memory regions during a write operation. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.
Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Arbitrary code execution in IBM Power Firmware across multiple firmware branches (FW1120.00, FW1110.x, FW1060.x, FW950.x, OP940.x) stems from a CWE-787 out-of-bounds write in the service processor mailbox interface. An authenticated attacker with service-level access to the BMC/FSP can exploit this buffer overflow to cross the trust boundary from the management processor into the host firmware runtime, gaining full control over the managed Power system. No public exploit has been identified at time of analysis; IBM has released a patch per advisory 7283236.
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.
Use-after-free in the FreeBSD 15.1-RELEASE kernel's kqueue subsystem allows an unprivileged local user to corrupt kernel memory and escalate privileges to root. During a fork() system call, the kernel's knote copy routine fails to hold appropriate locks while reading knote state, and does not guard against a timer-based knote firing and being enqueued on the active list mid-copy, resulting in a double-enqueue of the new knote and subsequent list corruption. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 8.4 (Local/No Privileges Required) reflects a realistic, high-severity local privilege escalation path on affected systems.
Privilege escalation in FreeBSD's RACK TCP stack via a use-after-free condition allows an unprivileged local user to achieve full system compromise. The RACK setsockopt(2) handler temporarily releases the connection lock while copying option data from userspace; if a concurrent context switches TCP stacks twice during this window, the stale saved pointer to the per-connection control block references freed memory while the integrity check erroneously passes. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches, with vendor patches confirmed via FreeBSD-SA-26:43.tcp; no public exploit has been identified at time of analysis.
Use-after-free in the FreeBSD kernel virtual memory subsystem allows an unprivileged local user to corrupt the pager's page list by calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object, then triggering a subsequent page fault. On object destruction, the affected page is freed twice, creating a kernel memory corruption primitive that may enable privilege escalation. No public exploit code has been identified and EPSS probability is very low (0.14%), but the vulnerability is confirmed by FreeBSD Security Advisory SA-26:37 with patches available for all affected release branches.
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the browser sandbox against users running Chrome prior to 151.0.7922.169. An unauthenticated remote attacker can trigger the vulnerability by luring a victim to a crafted HTML page, making this a drive-by exploitation scenario requiring only a single user interaction. Google has released a patch in stable channel version 151.0.7922.169; no public exploit or CISA KEV listing has been identified at time of analysis, though SSVC rates the technical impact as total.
Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.
Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.
Type confusion in V8, Chrome's JavaScript engine, enables arbitrary code execution inside the Chrome renderer sandbox on any platform (Windows, macOS, Linux) when a user visits an attacker-controlled HTML page. All Chrome releases prior to 151.0.7922.169 are affected; Google has released the patched stable-channel build. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates technical impact as total within the sandbox boundary.
Stack buffer overflow and off-by-one NUL-write vulnerabilities in the Sierra Wireless HL7800 cellular modem driver within Zephyr RTOS (versions 2.4.0 through 4.4.1) allow an attacker controlling a rogue LTE base station or a compromised modem baseband to crash or potentially execute arbitrary code in kernel context. Roughly twenty AT response handlers incorrectly size the destination argument to net_buf_linearize(), placing the null terminator one byte past a 128-byte stack buffer; the +KCELLMEAS handler is the most critical, passing the raw wire length as the destination size and enabling a full, attacker-content-driven stack overflow that runs in the driver's RX kernel thread. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
JIT miscompilation in Firefox's SpiderMonkey JavaScript engine exposes sensitive memory to remote attackers via crafted web content. The CWE-843 (type confusion) root cause means the JIT compiler generates native code that accesses a JavaScript value as the wrong type, resulting in a high-confidentiality information disclosure. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition and use-after-free memory corruption in Mozilla Firefox's Graphics component allows remote unauthenticated attackers to achieve limited confidentiality and integrity impact when a user visits a malicious web page. Affected across the standard release channel and all ESR branches, the vulnerability is fixed in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1 per Mozilla's official advisories. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC framework rates exploitation status as none and marks it not automatable.
Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAPH_RECOMPUTE handler, letting unauthenticated remote attackers gain arbitrary memory read/write and ultimately full RCE on any host exposing the distributed-inference RPC backend. An attacker stores a computation graph, frees the buffers it references, then reclaims that freed memory with attacker-controlled content before triggering re-execution against the dangling pointers. Reported by VulnCheck and fixed in b8585; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands to GPU Firmware, triggering writes outside the guest's virtualized GPU memory boundary (CWE-823). Affected are multiple DDK release trains including versions 25.1 RTM2 through 25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. No public exploit code exists and CISA has not added this to KEV; however, SSVC assesses total technical impact given successful exploitation yields full C/I/A compromise of the guest environment.
Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated exploitation, and IBM PSIRT has published a support advisory. There is no public exploit identified at time of analysis, EPSS is modest (0.61%, 47th percentile), and CISA SSVC rates exploitation as 'none' with technical impact 'total'.
Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise of the affected Unix host or virtualization I/O server. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.41%, 35th percentile), with CISA SSVC recording no observed exploitation.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger over the network without authentication or user interaction. Per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the flaw is critical (9.8) with total confidentiality, integrity, and availability impact, though the description does not name the specific network service or daemon that parses the malformed input. There is no public exploit identified at time of analysis, and EPSS is low (0.41%, 35th percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.
Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.
Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that lets a remote attacker overwrite memory and run arbitrary code on the host. IBM PSIRT rated it CVSS 9.8, and the vector indicates network-reachable, unauthenticated exploitation requiring no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE on an enterprise Unix platform makes it a high-priority patch.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger without authentication or user interaction, yielding full compromise of the affected system. IBM PSIRT rates it CVSS 9.8, reflecting complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a use-after-free (CWE-416) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 9.8). IBM has released a fix and there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.
Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.
Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local authenticated attacker with high privileges to execute arbitrary code on affected systems. The vulnerability is rooted in improper memory management (CWE-787) and carries a CVSS 3.1 score of 6.7, reflecting the local access requirement and elevated privilege prerequisite that constrain real-world exploitability. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.
Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.
Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.
Out-of-bounds write in Tor's consensus and detached signature parser allows remote, unauthenticated network peers to trigger memory corruption by supplying a document with an unexpected signature digest type. All Tor releases before 0.4.9.9 are affected; impact is minor for relay and client nodes but potentially major for directory authorities, whose compromise could disrupt or undermine the integrity of the network-wide consensus. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-reachable attack vector and scope change in the CVSS vector (S:C) warrant urgent patching for directory authority operators specifically.
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.
Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.
Type confusion in the Lean 4 proof assistant kernel allows a malicious metaprogram to produce a proof of False carrying no axioms, from which any proposition can be derived, completely breaking kernel soundness. The vulnerability arises from two related defects in src/kernel/inductive.cpp: projection expressions do not verify that the named structure matches the projected value's type, and environment::add_inductive fails to type-check the parametric arguments of nested inductive applications after they are replaced by auxiliary types, letting those arguments escape kernel verification entirely - exploitable through the normal maximum-kernel-checking addDecl path without sorry, unsafeCast, or unsafe annotations. Publicly available exploit code exists at multiple repositories; this CVE is not listed in CISA KEV.
Remote code execution in GStreamer's rtpsbcdepay plugin is achieved when a user processes a crafted RTP stream containing malformed SBC audio payload, triggering a use-after-free that corrupts heap memory and redirects execution to attacker-controlled code within the affected process. The flaw exists in all GStreamer installations where the rtpsbcdepay element is exercised, covering a broad surface area including Linux media players, VoIP clients, and Bluetooth audio gateways. No public exploit has been identified at time of analysis, but coordinated disclosure by ZDI (ZDI-CAN-29787) confirms technical reproduction, and a vendor security advisory (SA-2026-0051) has been published.
Remote code execution via malicious MRF media files affects GStreamer across all versions tracked under CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The MRF file parser fails to validate user-supplied input bounds, allowing a heap out-of-bounds write (CWE-787) that corrupts memory and redirects execution to attacker-controlled code within the victim process. Exploitation requires user interaction - opening a crafted file or visiting a page that triggers GStreamer parsing - and no public exploit or CISA KEV listing has been identified at time of analysis, though ZDI coordinated disclosure (ZDI-CAN-29510) and an upstream vendor advisory (sa-2026-0050) are both present.
Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds write in OriginPro's OGG file parsing component enables arbitrary code execution in the context of the current user's process when a crafted OGG file is opened. Affected installations include OriginPro 2026 SR1, as confirmed by ZDI (ZDI-CAN-29333 / ZDI-26-549) and EUVD-2026-63438. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though user interaction is the sole barrier to exploitation once a malicious file is delivered.
Out-of-bounds write in OriginPro's OPJ project file parser enables remote attackers to execute arbitrary code when a user opens a specially crafted OPJ file. The flaw, disclosed by Zero Day Initiative as ZDI-CAN-29332, results from insufficient validation of user-supplied data during file parsing - allowing a write past the end of an allocated data structure and full compromise of the target process. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis, but ZDI coordinated disclosure typically reduces the time-to-exploit development once advisories publish.
Remote code execution is achievable in OriginLab OriginPro through a maliciously crafted OPJU project file, exploiting an out-of-bounds write (CWE-787) in the application's file parser. OriginPro 2026 SR1 is confirmed affected per EUVD-2026-63436, with the CPE string suggesting broader version coverage may apply. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; however, ZDI discovery (ZDI-CAN-29331) indicates coordinated research disclosure, and the low attack complexity once the file is delivered makes this a meaningful risk to research and scientific computing environments.
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbitrary code at root privilege via the tchdr_bytestream_read function. The device - an in-vehicle infotainment/navigation unit - fails to bounds-check user-supplied data during bytestream parsing, resulting in a heap or stack write past the allocated buffer. No public exploit or active CISA KEV listing has been identified at time of analysis, and real-world impact is materially constrained by the physical access prerequisite.
Heap out-of-bounds write in GraphicsMagick's Photo CD (PCD) decoder enables heap memory corruption when processing a maliciously crafted PCD image. The DecodeImage() function in coders/pcd.c unconditionally advances its output pointer (q++) on every decoded Huffman delta without validating it against the end of the heap-allocated luma or chroma plane buffers, so an attacker-controlled PCD file can drive the pointer arbitrarily past the allocation boundary and overwrite adjacent heap memory. Any application invoking gm convert, gm identify, or linking against libGraphicsMagick while processing untrusted PCD files is at risk; no public exploit is identified at time of analysis.
Stack buffer overflow in GNU binutils 2.46.1 and earlier allows arbitrary code execution when a victim opens a crafted PE (Portable Executable) file using any binutils tool such as objdump or readelf. The out-of-bounds stack write (CWE-787) can corrupt return addresses, enabling attacker-controlled code execution in the victim's user context. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.8 High rating reflects full confidentiality, integrity, and availability impact if successfully exploited.
Use-after-free in libexpat before 2.8.4 allows an attacker who can supply crafted XML with a custom unknown-encoding declaration to corrupt parser memory when the encoding convert or release callback re-enters the parser without handler-depth tracking. Affected applications are those that register an UnknownEncodingHandler via XML_SetUnknownEncodingHandler - a non-default but legitimate usage pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.9 with AV:L/AC:H reflects the constrained exploitation prerequisites, though the library's wide deployment footprint elevates aggregate risk.
Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.
Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.
Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets an unauthenticated network attacker run arbitrary code by supplying malicious pointers that the OS fails to validate (CWE-843 type confusion). The flaw carries a critical CVSS 9.8 and was disclosed by IBM PSIRT with no user interaction required, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because AIX/VIOS underpins production IBM Power server estates, a working exploit would give attackers full compromise of the affected operating system.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local, high-privileged attacker to execute arbitrary code. The vulnerability is rooted in a memory corruption flaw (CWE-787) that can corrupt adjacent memory regions during a write operation. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.
Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Arbitrary code execution in IBM Power Firmware across multiple firmware branches (FW1120.00, FW1110.x, FW1060.x, FW950.x, OP940.x) stems from a CWE-787 out-of-bounds write in the service processor mailbox interface. An authenticated attacker with service-level access to the BMC/FSP can exploit this buffer overflow to cross the trust boundary from the management processor into the host firmware runtime, gaining full control over the managed Power system. No public exploit has been identified at time of analysis; IBM has released a patch per advisory 7283236.
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.
Use-after-free in the FreeBSD 15.1-RELEASE kernel's kqueue subsystem allows an unprivileged local user to corrupt kernel memory and escalate privileges to root. During a fork() system call, the kernel's knote copy routine fails to hold appropriate locks while reading knote state, and does not guard against a timer-based knote firing and being enqueued on the active list mid-copy, resulting in a double-enqueue of the new knote and subsequent list corruption. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 8.4 (Local/No Privileges Required) reflects a realistic, high-severity local privilege escalation path on affected systems.
Privilege escalation in FreeBSD's RACK TCP stack via a use-after-free condition allows an unprivileged local user to achieve full system compromise. The RACK setsockopt(2) handler temporarily releases the connection lock while copying option data from userspace; if a concurrent context switches TCP stacks twice during this window, the stale saved pointer to the per-connection control block references freed memory while the integrity check erroneously passes. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches, with vendor patches confirmed via FreeBSD-SA-26:43.tcp; no public exploit has been identified at time of analysis.
Use-after-free in the FreeBSD kernel virtual memory subsystem allows an unprivileged local user to corrupt the pager's page list by calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object, then triggering a subsequent page fault. On object destruction, the affected page is freed twice, creating a kernel memory corruption primitive that may enable privilege escalation. No public exploit code has been identified and EPSS probability is very low (0.14%), but the vulnerability is confirmed by FreeBSD Security Advisory SA-26:37 with patches available for all affected release branches.
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the browser sandbox against users running Chrome prior to 151.0.7922.169. An unauthenticated remote attacker can trigger the vulnerability by luring a victim to a crafted HTML page, making this a drive-by exploitation scenario requiring only a single user interaction. Google has released a patch in stable channel version 151.0.7922.169; no public exploit or CISA KEV listing has been identified at time of analysis, though SSVC rates the technical impact as total.
Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.
Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.
Type confusion in V8, Chrome's JavaScript engine, enables arbitrary code execution inside the Chrome renderer sandbox on any platform (Windows, macOS, Linux) when a user visits an attacker-controlled HTML page. All Chrome releases prior to 151.0.7922.169 are affected; Google has released the patched stable-channel build. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates technical impact as total within the sandbox boundary.
Stack buffer overflow and off-by-one NUL-write vulnerabilities in the Sierra Wireless HL7800 cellular modem driver within Zephyr RTOS (versions 2.4.0 through 4.4.1) allow an attacker controlling a rogue LTE base station or a compromised modem baseband to crash or potentially execute arbitrary code in kernel context. Roughly twenty AT response handlers incorrectly size the destination argument to net_buf_linearize(), placing the null terminator one byte past a 128-byte stack buffer; the +KCELLMEAS handler is the most critical, passing the raw wire length as the destination size and enabling a full, attacker-content-driven stack overflow that runs in the driver's RX kernel thread. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
JIT miscompilation in Firefox's SpiderMonkey JavaScript engine exposes sensitive memory to remote attackers via crafted web content. The CWE-843 (type confusion) root cause means the JIT compiler generates native code that accesses a JavaScript value as the wrong type, resulting in a high-confidentiality information disclosure. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition and use-after-free memory corruption in Mozilla Firefox's Graphics component allows remote unauthenticated attackers to achieve limited confidentiality and integrity impact when a user visits a malicious web page. Affected across the standard release channel and all ESR branches, the vulnerability is fixed in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1 per Mozilla's official advisories. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC framework rates exploitation status as none and marks it not automatable.
Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.