Memory Corruption
Monthly
Heap corruption via use-after-free in Google Chrome's Enterprise component allows a remote attacker to potentially execute arbitrary code when a victim visits a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Google rates the Chromium severity as Medium, but the CVSS 8.8 reflects full compromise of the browser process on successful exploitation; there is no public exploit identified at time of analysis and EPSS probability is low (0.18%). A vendor patch is available in the 151.0.7922.72 stable channel.
Heap corruption in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) allows a remote attacker to exploit a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer process. The flaw is a CWE-416 object-lifecycle error rated CVSS 8.8 with user interaction required. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), indicating no observed weaponization despite the high CVSS.
Sandboxed remote code execution in Google Chrome's WebXR implementation (all channels prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Google rates the Chromium security severity as Medium, though the CVSS 8.8 reflects high impact contingent on user interaction; no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile). Note a source conflict: the description cites an integer overflow while the CWE and tags indicate use-after-free/memory corruption.
Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). No public exploit has been identified at time of analysis and the EPSS score is low (0.21%, 11th percentile), and code execution is confined to the sandbox, meaning a separate sandbox-escape chain would be needed for full host compromise.
Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. Despite a CVSS of 8.8, Chromium rated the security severity Medium and EPSS is low (0.21%, 12th percentile), and the impact is constrained to code execution within the sandbox rather than full host compromise.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. There is no public exploit identified at time of analysis and EPSS probability is low (0.17%, 7th percentile), indicating this is a second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome's ANGLE graphics layer on Windows (versions prior to 151.0.7922.72) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free that can potentially break out of the renderer/GPU sandbox. Google rated the Chromium security severity Medium and has shipped a fix; there is no public exploit identified at time of analysis and the EPSS score is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood despite the serious impact class.
Sandboxed arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) lets a remote attacker run code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 8.8 with a Chromium severity of Medium; a vendor patch is available. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21%.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 stems from a use-after-free in the Media component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the underlying bug Medium severity, but the reported CVSS is 9.6 due to the scope-changing sandbox-escape impact; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile). A vendor patch is available.
Use-after-free in the Audio component of Google Chrome for macOS enables a potential sandbox escape in versions prior to 151.0.7922.72. Exploitation is a two-stage attack: an attacker must first compromise the renderer process (via a separate vulnerability), then leverage this Audio UAF through a crafted HTML page to break out of the Chrome sandbox. No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) signals low observed exploitation probability despite the high CVSS score of 8.8; vendor-released patch 151.0.7922.72 is available.
Sandbox-confined remote code execution in Google Chrome's Extensions component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted Chrome Extension, exploiting a use-after-free (CWE-416). Chromium rated the severity Medium because execution is contained within the sandbox rather than achieving full host compromise, though the NVD-style CVSS is 8.8. There is no public exploit identified at time of analysis, and EPSS is low at 0.24% (15th percentile).
Heap corruption in Google Chrome for Mac (Views UI component) prior to 151.0.7922.72 allows a remote attacker to potentially exploit a use-after-free by luring a victim to a crafted HTML page. The flaw is a memory-corruption bug that, if successfully leveraged, could lead to arbitrary code execution within the renderer/browser process; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Google rates the Chromium security severity as Medium, though the assigned CVSS of 8.8 reflects the full-impact potential typical of browser memory-corruption bugs.
Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 151.0.7922.72, where a remote attacker can serve a crafted HTML page to trigger a use-after-free and potentially break out of the renderer sandbox. Google rates the Chromium security severity as Medium; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.21% (11th percentile). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and a vendor patch is already available.
Use-after-free in the V8 JavaScript engine within Google Chrome versions prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to perform out-of-bounds memory access via a crafted HTML page. Despite a CVSS score of 8.8, this is not a standalone remote code execution path - it requires a pre-existing renderer compromise as an explicit precondition, placing it firmly in the category of a second-stage chained exploit. No public exploit code has been identified, CISA has not added this to the KEV catalog, and EPSS sits at 0.22% (13th percentile), consistent with targeted rather than mass exploitation risk. A vendor-released patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw requires only that the user visit a malicious site; no authentication is needed but user interaction is. There is no public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation is not yet widespread.
Sandbox escape in Google Chrome's Media component on Windows (versions before 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page, exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it enables a scope-changing escalation from constrained renderer code to broader host access. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Android WebView allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page in versions prior to 151.0.7922.72. Rooted in a use-after-free (object lifecycle) flaw rated High by Chromium, this is a second-stage privilege-boundary bypass rather than a standalone entry point. No public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a bug reported internally by the Chrome team and patched before evidence of exploitation.
Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.
Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.
Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. There is no public exploit identified at time of analysis, EPSS is low at 0.31% (24th percentile), and CISA's SSVC marks exploitation as none.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.
Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. There is no public exploit identified and no CISA KEV listing, and EPSS is low at 0.31% (24th percentile), indicating no evidence of active exploitation at time of analysis.
Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.
Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.
Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.
Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.
Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.
Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.
Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Use-after-free in Node.js HTTP/2 implementation allows remote unauthenticated attackers to crash the Node.js process by sending crafted HTTP/2 RST_STREAM frames while the stream object remains in scope. The fix - 'defer rst stream while in scope' - confirms that RST_STREAM processing freed or invalidated memory still referenced by the active stream context. With CVSS A:H and AV:N/AC:L/PR:N/UI:N, this is a straightforward remote denial-of-service against any Node.js server with HTTP/2 enabled. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and multi-LTS-branch impact make patching urgent.
Out-of-bounds write in Schneider Electric IGSS (Interactive Graphical SCADA System) Definition module allows an attacker to corrupt memory - causing data loss or potential arbitrary code execution - when a victim imports a maliciously crafted CGF (configuration/definition) file. Exploitation is local and hinges on user interaction (opening/importing the file), with no authentication required once the operator is tricked. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Schneider Electric PSIRT) rates the flaw high at CVSS 8.4.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.
Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Type confusion in macOS and tvOS may allow a malicious app to trigger unexpected system termination and potentially achieve arbitrary code execution with kernel-level privileges. The issue is addressed in macOS Tahoe 26.6 and tvOS 26.6; no active exploitation or public proof-of-concept is known at the time of analysis.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation
Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.
A type confusion vulnerability in macOS allows an application to cause unexpected system termination (denial of service). Affected versions include macOS Sequoia, Sonoma, and Tahoe prior to the fixed releases; the issue has been patched by Apple. No public exploit is known, and EPSS indicates very low exploitation probability, with no active exploitation reported.
Unexpected system termination in macOS prior to Sequoia 15.7.8 and Tahoe 26.6 allows a local application to crash the operating system via an out-of-bounds write. Although the vulnerability is assigned a critical CVSS 9.8 due to potential memory corruption risks, the Apple advisory only confirms denial-of-service impact. No active exploitation is reported, and EPSS (0.15%) indicates low exploitation probability.
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected application termination or heap corruption via unspecified vectors. Given a CVSS score of 9.8, successful exploitation could lead to full system compromise. Patches are available from Apple in multiple OS updates, and no public exploit or active exploitation has been identified.
Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).
A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.
Arbitrary code execution in Apple iOS and iPadOS, macOS, tvOS, visionOS, and watchOS permits an attacker to run code or terminate apps by luring a user into opening a crafted file. The out-of-bounds write issue was fixed in all supported Apple operating systems via June 2026 updates. No active exploitation or public proof-of-concept has been reported at time of analysis, and EPSS indicates a low probability of future exploitation.
Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
Use-after-free in SQLite 3.41's JSON parser allows remote code execution. A remote attacker can deliver a crafted JSON payload; if a user or application processes it with SQLite, the vulnerability triggers memory corruption, potentially enabling full system compromise. A proof-of-concept advisory is publicly available, though no active exploitation has been confirmed.
Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.
Remote denial of service and heap memory leak in SQLite 3.41 via the json_remove() function allows attackers with the ability to execute SQL queries to crash the database process or leak sensitive heap data. A use-after-free in jsonRemoveFunc is triggered by malformed JSON and a deep path parameter; publicly available proof-of-concept code exists, and low EPSS risk indicates limited exploitation likelihood.
Use-after-free in SQLite 3.41 allows remote attackers supplying crafted SQL to trigger memory corruption during parsing, leading to denial of service, sensitive information leakage, and potential arbitrary code execution.
Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.
Heap corruption via use-after-free in Google Chrome's Enterprise component allows a remote attacker to potentially execute arbitrary code when a victim visits a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Google rates the Chromium severity as Medium, but the CVSS 8.8 reflects full compromise of the browser process on successful exploitation; there is no public exploit identified at time of analysis and EPSS probability is low (0.18%). A vendor patch is available in the 151.0.7922.72 stable channel.
Heap corruption in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) allows a remote attacker to exploit a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer process. The flaw is a CWE-416 object-lifecycle error rated CVSS 8.8 with user interaction required. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), indicating no observed weaponization despite the high CVSS.
Sandboxed remote code execution in Google Chrome's WebXR implementation (all channels prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Google rates the Chromium security severity as Medium, though the CVSS 8.8 reflects high impact contingent on user interaction; no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile). Note a source conflict: the description cites an integer overflow while the CWE and tags indicate use-after-free/memory corruption.
Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). No public exploit has been identified at time of analysis and the EPSS score is low (0.21%, 11th percentile), and code execution is confined to the sandbox, meaning a separate sandbox-escape chain would be needed for full host compromise.
Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. Despite a CVSS of 8.8, Chromium rated the security severity Medium and EPSS is low (0.21%, 12th percentile), and the impact is constrained to code execution within the sandbox rather than full host compromise.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. There is no public exploit identified at time of analysis and EPSS probability is low (0.17%, 7th percentile), indicating this is a second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome's ANGLE graphics layer on Windows (versions prior to 151.0.7922.72) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free that can potentially break out of the renderer/GPU sandbox. Google rated the Chromium security severity Medium and has shipped a fix; there is no public exploit identified at time of analysis and the EPSS score is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood despite the serious impact class.
Sandboxed arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) lets a remote attacker run code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 8.8 with a Chromium severity of Medium; a vendor patch is available. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21%.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 stems from a use-after-free in the Media component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the underlying bug Medium severity, but the reported CVSS is 9.6 due to the scope-changing sandbox-escape impact; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile). A vendor patch is available.
Use-after-free in the Audio component of Google Chrome for macOS enables a potential sandbox escape in versions prior to 151.0.7922.72. Exploitation is a two-stage attack: an attacker must first compromise the renderer process (via a separate vulnerability), then leverage this Audio UAF through a crafted HTML page to break out of the Chrome sandbox. No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) signals low observed exploitation probability despite the high CVSS score of 8.8; vendor-released patch 151.0.7922.72 is available.
Sandbox-confined remote code execution in Google Chrome's Extensions component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted Chrome Extension, exploiting a use-after-free (CWE-416). Chromium rated the severity Medium because execution is contained within the sandbox rather than achieving full host compromise, though the NVD-style CVSS is 8.8. There is no public exploit identified at time of analysis, and EPSS is low at 0.24% (15th percentile).
Heap corruption in Google Chrome for Mac (Views UI component) prior to 151.0.7922.72 allows a remote attacker to potentially exploit a use-after-free by luring a victim to a crafted HTML page. The flaw is a memory-corruption bug that, if successfully leveraged, could lead to arbitrary code execution within the renderer/browser process; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Google rates the Chromium security severity as Medium, though the assigned CVSS of 8.8 reflects the full-impact potential typical of browser memory-corruption bugs.
Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 151.0.7922.72, where a remote attacker can serve a crafted HTML page to trigger a use-after-free and potentially break out of the renderer sandbox. Google rates the Chromium security severity as Medium; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.21% (11th percentile). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and a vendor patch is already available.
Use-after-free in the V8 JavaScript engine within Google Chrome versions prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to perform out-of-bounds memory access via a crafted HTML page. Despite a CVSS score of 8.8, this is not a standalone remote code execution path - it requires a pre-existing renderer compromise as an explicit precondition, placing it firmly in the category of a second-stage chained exploit. No public exploit code has been identified, CISA has not added this to the KEV catalog, and EPSS sits at 0.22% (13th percentile), consistent with targeted rather than mass exploitation risk. A vendor-released patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw requires only that the user visit a malicious site; no authentication is needed but user interaction is. There is no public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation is not yet widespread.
Sandbox escape in Google Chrome's Media component on Windows (versions before 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page, exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it enables a scope-changing escalation from constrained renderer code to broader host access. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Android WebView allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page in versions prior to 151.0.7922.72. Rooted in a use-after-free (object lifecycle) flaw rated High by Chromium, this is a second-stage privilege-boundary bypass rather than a standalone entry point. No public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a bug reported internally by the Chrome team and patched before evidence of exploitation.
Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.
Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.
Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. There is no public exploit identified at time of analysis, EPSS is low at 0.31% (24th percentile), and CISA's SSVC marks exploitation as none.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.
Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. There is no public exploit identified and no CISA KEV listing, and EPSS is low at 0.31% (24th percentile), indicating no evidence of active exploitation at time of analysis.
Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.
Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.
Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.
Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.
Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.
Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.
Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Use-after-free in Node.js HTTP/2 implementation allows remote unauthenticated attackers to crash the Node.js process by sending crafted HTTP/2 RST_STREAM frames while the stream object remains in scope. The fix - 'defer rst stream while in scope' - confirms that RST_STREAM processing freed or invalidated memory still referenced by the active stream context. With CVSS A:H and AV:N/AC:L/PR:N/UI:N, this is a straightforward remote denial-of-service against any Node.js server with HTTP/2 enabled. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and multi-LTS-branch impact make patching urgent.
Out-of-bounds write in Schneider Electric IGSS (Interactive Graphical SCADA System) Definition module allows an attacker to corrupt memory - causing data loss or potential arbitrary code execution - when a victim imports a maliciously crafted CGF (configuration/definition) file. Exploitation is local and hinges on user interaction (opening/importing the file), with no authentication required once the operator is tricked. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Schneider Electric PSIRT) rates the flaw high at CVSS 8.4.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.
Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Type confusion in macOS and tvOS may allow a malicious app to trigger unexpected system termination and potentially achieve arbitrary code execution with kernel-level privileges. The issue is addressed in macOS Tahoe 26.6 and tvOS 26.6; no active exploitation or public proof-of-concept is known at the time of analysis.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation
Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.
A type confusion vulnerability in macOS allows an application to cause unexpected system termination (denial of service). Affected versions include macOS Sequoia, Sonoma, and Tahoe prior to the fixed releases; the issue has been patched by Apple. No public exploit is known, and EPSS indicates very low exploitation probability, with no active exploitation reported.
Unexpected system termination in macOS prior to Sequoia 15.7.8 and Tahoe 26.6 allows a local application to crash the operating system via an out-of-bounds write. Although the vulnerability is assigned a critical CVSS 9.8 due to potential memory corruption risks, the Apple advisory only confirms denial-of-service impact. No active exploitation is reported, and EPSS (0.15%) indicates low exploitation probability.
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected application termination or heap corruption via unspecified vectors. Given a CVSS score of 9.8, successful exploitation could lead to full system compromise. Patches are available from Apple in multiple OS updates, and no public exploit or active exploitation has been identified.
Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).
A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.
Arbitrary code execution in Apple iOS and iPadOS, macOS, tvOS, visionOS, and watchOS permits an attacker to run code or terminate apps by luring a user into opening a crafted file. The out-of-bounds write issue was fixed in all supported Apple operating systems via June 2026 updates. No active exploitation or public proof-of-concept has been reported at time of analysis, and EPSS indicates a low probability of future exploitation.
Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
Use-after-free in SQLite 3.41's JSON parser allows remote code execution. A remote attacker can deliver a crafted JSON payload; if a user or application processes it with SQLite, the vulnerability triggers memory corruption, potentially enabling full system compromise. A proof-of-concept advisory is publicly available, though no active exploitation has been confirmed.
Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.
Remote denial of service and heap memory leak in SQLite 3.41 via the json_remove() function allows attackers with the ability to execute SQL queries to crash the database process or leak sensitive heap data. A use-after-free in jsonRemoveFunc is triggered by malformed JSON and a deep path parameter; publicly available proof-of-concept code exists, and low EPSS risk indicates limited exploitation likelihood.
Use-after-free in SQLite 3.41 allows remote attackers supplying crafted SQL to trigger memory corruption during parsing, leading to denial of service, sensitive information leakage, and potential arbitrary code execution.
Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.